feat: Experimental Sandbox Support (#101)

* feat: Sandbox implementation with seatbelt * refactor: Remove concept of PM_CACHE * fix: Misc fixes * refactor: Sandbox for separation of boundaries * fix: Apply API * fix: Add support for sandbox cleanup * test: Add variable interpolation test * fix: Misc cleanup fixes * chore: Cleanup sandbox registry * chore: Cleanup sandbox policy * chore: Cleanup sandbox * fix: Misc cleanup fixes * fix: Remove violation mode * fix: Update config template * chore: Go mod cleanup * fix: Handle the case when package manager policy is explicitly disabled * fix: Sandbox executor * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com> * test: Remove unused var * test: Add test for seatbelt sandbox driver * fix: Sandbox profile loader from file should use path for caching * test: Add policy test * feat: Add support for config templates * fix: Seatbelt translator handle glob * fix: Merge conflicts * fix: Fix sandbox policy generator for MacOS min permissions * fix: Sandbox path handling bugs * fix: Deny read to dangerous directories * fix: Deny read to dangerous directories * add sandbox e2e (#112) * fix: Sandbox E2E test * fix: Code review fixes * fix: Code review fixes * doc: Add sandbox debugging guide * doc: Update sandbox doc * docs: Add sandbox usage doc * fix: Use better error for sandbox without policy * fix: Add sandbox for npx * fix: Enable PTY for npm --------- Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com>
2026-08-03 07:24:09 +02:00 · 2026-01-13 14:52:02 +05:30
parent c0122898ca
commit 9693428171
35 changed files with 3826 additions and 29 deletions
@@ -46,3 +46,74 @@ experimental_proxy_mode: false
 trusted_packages:
  - purl: pkg:npm/@safedep/pmg
    reason: "PMG is a trusted package for PMG"
+
+# Sandbox configuration (EXPERIMENTAL)
+# When enabled, package managers run in sandbox environments with restricted
+# filesystem, network, and process execution access. This provides defense-in-depth
+# protection against malicious install scripts and supply chain attacks.
+#
+# When sandboxing is enabled for a package manager, policy violations will block execution
+# (no "warn-only" mode). Sandboxing itself can be disabled globally or per package manager.
+#
+# Currently supported platforms:
+# - macOS (using Seatbelt sandbox-exec)
+# - Linux (planned: Bubblewrap or seccomp-bpf)
+# - Windows (planned)
+sandbox:
+  # Enable sandbox mode (opt-in, default: false for backward compatibility)
+  enabled: false
+
+  # Policy templates define policy profiles by name and path.
+  # They can be used to override a built-in profile or create a custom profile.
+  policy_templates:
+    # Name for the template. Can be used to override a built-in profile or create a custom profile.
+    # Path is the path to the template file.
+    # Relative path can be used to reference a template file in the config directory (example: ./npm-restrictive.yml)
+    npm-restrictive-override:
+      path: ./profiles/npm-restrictive.yml
+
+  # Per-package-manager sandbox policies
+  # Each package manager can have its own policy to account for unique security characteristics
+  policies:
+    # npm ecosystem. npm-restrictive is a built-in profile.
+    npm:
+      enabled: true
+      profile: npm-restrictive  # Built-in profile, template name, or path to custom YAML
+
+    pnpm:
+      enabled: true
+      profile: npm-restrictive
+
+    npx:
+      enabled: true
+      profile: npm-restrictive
+
+    pnpx:
+      enabled: true
+      profile: npm-restrictive
+
+    yarn:
+      enabled: true
+      profile: npm-restrictive
+
+    bun:
+      enabled: true
+      profile: npm-restrictive
+
+    # PyPI ecosystem. pypi-restrictive is a built-in profile.
+    pip:
+      enabled: true
+      profile: pypi-restrictive
+
+    pip3:
+      enabled: true
+      profile: pypi-restrictive
+
+    poetry:
+      enabled: true
+      profile: pypi-restrictive
+
+    uv:
+      enabled: true
+      profile: pypi-restrictive
+