shellmcp: bwrap read-only sandbox with hidden paths

2026-11-05 10:17:15 +01:00
parent 95efaa5dfd
commit b95c3d662b
2 changed files with 26 additions and 0 deletions
@@ -44,3 +44,15 @@ def run(command, cwd, timeout=60, limit=8000, prefix=()):
            out = b""
        head = f"timed out after {timeout} s, killed"
    return f"{head}\n{cut(out.decode(errors='replace'), limit)}"
+
+def sandbox(cwd, hide=()):
+    """The bwrap argv prefix of --mode readonly."""
+    argv = ["bwrap", "--ro-bind", "/", "/", "--dev", "/dev", "--proc", "/proc",
+            "--tmpfs", "/tmp", "--tmpfs", "/run", "--unshare-net", "--unshare-ipc",
+            "--unshare-pid", "--die-with-parent", "--new-session"]
+    for path in hide:
+        if os.path.isdir(path):
+            argv += ["--tmpfs", path]
+        elif os.path.exists(path):
+            argv += ["--ro-bind", "/dev/null", path]
+    return argv + ["--chdir", cwd]