Sandbox Runtime Improvements
Open
Nobody has claimed this yet.
roadmap
- Dominant language
- Rust
- Stars
- 8.7k
- Forks
- 1.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 253
Description
Improvements to the sandbox and supervisor machinery itself.
- We should be able to sandbox any arbitrary container, not just containers specifically configured for OpenShell.
- Drop elevated privileges such as
CAP_SYS_ADMINfor running the supervisor. - Support different topologies such as running the supervisor simply as a network proxy.
- Implement various isolation backends.
- Configure Sandboxes with driver specific properties.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files, tests, or entry points are named. Start by locating the existing sandbox and supervisor machinery, then determine which checklist item has a defined scope and implementation path. Done would require a separately agreed design and validation for the selected capability, since the issue currently groups several cross-cutting improvements.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- infrastructure, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100