feat: Add support for config templates

config/config.go

@@ -73,6 +73,17 @@ type SandboxConfig struct {
 	// Policies maps package manager names to their sandbox policy references.
 	// Key is package manager name (e.g., "npm", "pip"), value is policy reference.
 	Policies map[string]SandboxPolicyRef `mapstructure:"policies"`
+
+	// PolicyTemplates maps template names to their paths.
+	PolicyTemplates map[string]SandboxPolicyTemplate `mapstructure:"policy_templates"`
+}
+
+// SandboxPolicyTemplate defines a template for a sandbox policy, used to map
+// a profile name to a path.
+type SandboxPolicyTemplate struct {
+	// Path is the path to the template file.
+	// Relative path can be used to reference a template file in the config directory (example: ./npm-restrictive.yml)
+	Path string `mapstructure:"path"`
 }
 
 // SandboxPolicyRef references a sandbox policy for a specific package manager.
@@ -130,6 +141,11 @@ func (r *RuntimeConfig) EventLogDir() string {
 	return r.eventLogDir
 }
 
+// ConfigDir returns the path to the config directory.
+func (r *RuntimeConfig) ConfigDir() string {
+	return r.configDir
+}
+
 // DefaultConfig is a fail safe contract for the runtime configuration.
 // The config package return an appropriate RuntimeConfig based on the environment and the configuration.
 func DefaultConfig() RuntimeConfig {

config/config.template.yml

@@ -63,13 +63,22 @@ sandbox:
   # Enable sandbox mode (opt-in, default: false for backward compatibility)
   enabled: false
 
+  # Policy templates define policy profiles by name and path.
+  # They can be used to override a built-in profile or create a custom profile.
+  policy_templates:
+    # Name for the template. Can be used to override a built-in profile or create a custom profile.
+    # Path is the path to the template file.
+    # Relative path can be used to reference a template file in the config directory (example: ./npm-restrictive.yml)
+    npm-restrictive-override:
+      path: ./profiles/npm-restrictive.yml
+
   # Per-package-manager sandbox policies
   # Each package manager can have its own policy to account for unique security characteristics
   policies:
-    # npm ecosystem
+    # npm ecosystem. npm-restrictive is a built-in profile.
     npm:
       enabled: true
-      profile: npm-restrictive  # Built-in profile or path to custom YAML
+      profile: npm-restrictive  # Built-in profile, template name, or path to custom YAML
 
     pnpm:
       enabled: true
@@ -83,7 +92,7 @@ sandbox:
       enabled: true
       profile: npm-restrictive
 
-    # PyPI ecosystem
+    # PyPI ecosystem. pypi-restrictive is a built-in profile.
     pip:
       enabled: true
       profile: pypi-restrictive