From b38d177707e35454e101c6d059b9acf9d0cf8cca Mon Sep 17 00:00:00 2001 From: Abhisek Datta Date: Thu, 8 Jan 2026 20:51:15 +0530 Subject: [PATCH] fix: Sandbox executor --- sandbox/executor/apply.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sandbox/executor/apply.go b/sandbox/executor/apply.go index ca147b3..5b8cd23 100644 --- a/sandbox/executor/apply.go +++ b/sandbox/executor/apply.go @@ -40,6 +40,10 @@ func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string) (*sandbox.E } else { log.Debugf("Looking up sandbox policy for %s", pmName) + // When a policy is not configured for a package manager, we error out + // This is to avoid running the command without sandbox protection. + // To bypass sandbox for a specific package manager, users should explicitly + // disable for the package manager in the config. policyRef, exists := cfg.Config.Sandbox.Policies[pmName] if !exists { return nil, fmt.Errorf("no sandbox policy configured for %s", pmName)