security//sandbox

A sandbox is an execution environment that deliberately restricts what code can reach or change. Useful boundaries include filesystem paths, processes, network destinations, devices, credentials, system calls and resource consumption.

A sandbox is an execution environment that deliberately restricts what code can reach or change. Useful boundaries include filesystem paths, processes, network destinations, devices, credentials, system calls and resource consumption.

Isolation is not a decorative container label. A sandbox that mounts production secrets or permits unrestricted outbound traffic may isolate one dimension while leaving the consequential ones open. The design question is always: if the workload becomes adversarial, what remains unreachable?

A good sandbox does not promise that code will behave. It makes misbehavior boring and bounded.