Skip to content
portcullis portcullis

Sandboxing & the runner

Tool logic runs in pc-runner, one process per invocation, never in the edge (Directive #1). On Linux the runner establishes, in the forked child before exec:

  • fresh user / mount / net / uts / ipc namespaces (an empty network namespace makes cloud metadata and the broker unreachable by construction);
  • id mapping to an unprivileged uid via the user namespace;
  • a read-only root;
  • a landlock filesystem ruleset limited to the spec’s declared paths;
  • no-new-privileges; and
  • a seccomp filter from an operator-owned, reviewed JSON profile.

This is Linux kernel machinery with no portable equivalent. On other platforms the runner returns Unsupported and fails closed — it never runs a tool without a sandbox.