External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: Add Sandbox Inspection and Debugging Commands (#261)

Browse Source 
* feat: add sandbox DX commands

* fix: Linter errors

* fix: Sandbox deny log parsing

* fix: Sandbox docs

* refactor: Maintain SSOT across pkg dependencies

* fix: Linter errors
This commit is contained in:
Abhisek Datta
2026-05-19 14:40:54 +05:30
committed by GitHub
parent 46cc70db53
commit b8588e3df4
97 changed files with 8796 additions and 478 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/sandbox.md
+48
View File
@@ -80,6 +80,9 @@ See [Bubblewrap Installation](https://github.com/containers/bubblewrap#installat
See [configuration](./config.md) and [config/config.template.yml](../config/config.template.yml) for the configuration schema.
Once sandbox is enabled, you can run package manager commands with sandbox protection.
Run `pmg sandbox doctor` to see platform specific sandbox setup and driver status. Continue using
PMG as usual, sandbox will be applied to configured package managers automatically.
```bash
pmg npm install express
```
@@ -96,6 +99,51 @@ Run sandbox with custom policy file:
pmg --sandbox --sandbox-profile=/path/to/custom-policy.yml npm install express
```
### Sandbox Profile Commands
Use profile commands to inspect, create, and validate sandbox profiles.
```bash
# List built-in and user profiles
pmg sandbox profile list
# Scaffold a user profile that inherits from a built-in
pmg sandbox profile init my-npm --from npm-restrictive
# Show a profile, or its fully resolved policy
pmg sandbox profile show npm-restrictive
pmg sandbox profile show npm-restrictive --resolved
# Lint a built-in, user profile, or profile file
pmg sandbox profile lint npm-restrictive
pmg sandbox profile lint ./my-profile.yml --strict
# Compare two resolved profiles
pmg sandbox profile diff npm-restrictive pypi-restrictive
```
### Sandbox Debug Commands
Use these commands when a sandboxed package manager command fails and you need to inspect why.
```bash
# Check sandbox driver availability and host setup
pmg sandbox doctor
# List recent sandbox denials captured by PMG
pmg sandbox violations list
# Explain the latest captured denial and show a suggested override when possible
pmg sandbox explain --last
# Inspect the resolved policy PMG will apply
pmg sandbox profile show npm-restrictive --resolved
```
`pmg sandbox doctor` runs platform-specific checks for the current host. Cached violation reports
used by `violations list` and `explain --last` are currently produced by macOS Seatbelt diagnostics;
on Linux, Bubblewrap and Landlock denials may only appear as command errors such as `EACCES`.
### Runtime Allow Overrides
Use `--sandbox-allow` to make one-off exceptions without creating a custom profile. This is useful