Skip to content

Launch Sandbox

Graduation from the host-worktree lab. Default is print the plan. --run only with explicit approval.

Procedure

  1. Confirm the user wants execute/network/untrusted-build (not mere reading).
  2. Print the policy plan:
make sandbox IMAGE=IMAGE
  1. Show the argv. Do not add --privileged or drop --network none.
  2. --run only after the user approves the image digest and findings path.
  3. Persist findings only. Tear down the container. Host open-lab trees stay read-only.

Anti-patterns

  • Don't bind-mount the host repo.
  • Don't run the target on the host worktree.