chore: Cleanup sandbox policy

This commit is contained in:
Abhisek Datta
2026-01-08 16:26:18 +05:30
parent 8ba18338d9
commit 45049b001d
2 changed files with 0 additions and 22 deletions
-19
View File
@@ -8,28 +8,10 @@ This directory contains built-in sandbox policies for PMG package managers.
Restrictive policy for the npm ecosystem (npm, pnpm, yarn, bun).
**Features:**
- Allows read access to current directory, package manager configs, and caches
- Restricts write access to `node_modules/` and lockfiles only
- Blocks access to sensitive files (`~/.ssh`, `~/.aws`, `.env` files)
- Allows network access to npm registries only
- Permits Node.js and git execution, blocks shell and curl/wget
**Use when:** You want balanced protection for npm package installations
### pypi-restrictive
Restrictive policy for the PyPI ecosystem (pip, pip3, poetry, uv).
**Features:**
- Allows read access to current directory, pip configs, and caches
- Restricts write access to virtual environments and package caches
- Blocks access to sensitive files (`~/.ssh`, `~/.aws`, `.env` files)
- Allows network access to PyPI registries only
- Permits Python, compilers (for native extensions), and git
**Use when:** You want balanced protection for pip package installations
## Custom Policies
You can create custom sandbox policies by:
@@ -55,7 +37,6 @@ See the [Policy Schema Documentation](../policy.go) for details on the YAML stru
- `${HOME}`: User home directory
- `${CWD}`: Current working directory
- `${PM_CACHE}`: Package manager cache directory
- `${TMPDIR}`: Temporary directory
### Violation Modes