-Packj sandbox creates a network firewall and an isolated filesystem layer by interposing on system calls (e.g., `open`, `connect`) with [strace](https://github.com/strace/strace) and re-writing system calls arguments (e.g., file path) as per the sandboxing rules in `config.yaml`. Rewriting ensures that all file system modifications are confined to the isolated layer. As a result, the requested package is **ONLY** installed in the sandboxed file system. All network and file system activities are logged. At the end, the user can review these activities before commiting to the host filesystem to **actually** install the package (i.e., copy artifacts).
0 commit comments