Cordon (Sandbox) Settings

Also settable in a profile configuration to override the base configuration.

New in 0.9.11 Enkaidu supports sandboxing execution of shell commands for platforms that support it. On macOS this is done using the built-in sandbox-exec helper command. On Linux platforms Enkaidu looks for bubblewrap which has to be installed by the user.

Warning If your platform does not have a supported sandbox, then Enkaidu runs in unsafe mode and runs shell commands directly.

• cordon:
  • confirm: defaults to true, to confirm if cordon is available for your platform.
  • mode: use this to set how the cordon is deployed, or disabled, by using one of the following values:
    • commands (default) to run shell commands within a cordon
    • unsafe to not use a cordon
  • policy: can be used to define custom policy rules for the cordon.
    • read_only_paths: [...] (default []) array of paths to allow read-only access from within the cordon; executables in these paths are allowed to be run as well.
    • read_write_paths: [...] (default []) array of paths where read and write access is allowed from within the cordon.
    • New in 0.9.13 allow_network: true | false (default false) to enable networking (inbound, outbound, and binding) for commands executed within the cordon. When false, nothing run in the cordon gets network access.
    • New in 0.9.14 Per-command granularity: when allow_network is true, network access is granted per command — only commands that prefix-match an entry in shell_command’s network_allowed_commands run with network access; every other allowed command runs without it. There is still no way to restrict hosts or ports, so enable with care. See shell command execution.
  • workspace: Properties here can be used enable / configure presets specific to your workspace.
    • using_brew: true | false (default false) to ensure brew-installed commands are reachable from within the cordon
    • using_ruby: in two ways
      • using_ruby: true (default false) to use platform-supplied Ruby, including brew-installed Ruby if using_brew is true.
      • using_ruby:
        • ruby_path: PATH_STR will ensure the Ruby at this location is allowed
    • using_python: in two ways
      • using_python: true (default false) to use platform-supplied Python, including brew-installed Python if using_brew is true.
      • using_python:
        • venv_path: PATH_STR will ensure Python virtual environment is allowed.
    • New in 0.9.16 using_crystal: in two ways
      • using_crystal: true (default false) to use the $HOME-based shared cache folder.
      • using_crystal:
        • shared_cache_path: PATH_STR sets a custom location for the Crystal shared cache used to improve compilation times.

Example

cordon:
  # shell commands run inside the cordon
  mode: commands            
  policy:
    read_only_paths:
      - /usr/share/zoneinfo
    read_write_paths:
      - ./scratch
    # networking for cordon commands is off by default; when true,
    # only commands matching shell_command's network_allowed_commands get it
    allow_network: false
  workspace:
    using_brew: true
    using_ruby: true
    using_crystal: true