Bring back pledge/SECCOMP sandboxing (#930)#1015

Open

aittalam wants to merge 8 commits into

mainfrom

Commits on Jul 3, 2026

Commits on Jul 4, 2026

Harden pledge/SECCOMP sandbox: unveil confinement, thread coverage, testable policy

aittalam
and
claude
committed
Sandbox review round 2: complete/robust unveil, close CLI/chat thread gap

aittalam
and
claude
committed

Commits on Jul 13, 2026

sandbox: use benign world-readable canaries, not /etc/passwd

aittalam
and
claude
committed
sandbox: split pledge (default-on) from unveil (opt-in --confine-reads)

aittalam
and
claude
committed
sandbox: minor review follow-ups on --confine-reads

aittalam
and
claude
committed