clash_starlark 0.7.2

Starlark policy evaluator for Clash — compiles .star files to JSON policy
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

docker_safe = sandbox(
    name = "docker_safe",
    default = ask(),
    fs = {
        subpath("$PWD"): allow("rx"),
        "$HOME": {
            ".docker/config.json": allow("r"),
        },
        glob("$TMPDIR/**"): allow(),
    },
    net = allow(),
    doc = "Docker safe: ps, images, inspect, logs. Read-only project, Docker daemon access.",
)

docker_full = sandbox(
    name = "docker_full",
    default = ask(),
    fs = {
        subpath("$PWD"): allow(FULL),
        "$HOME": {
            glob(".docker/**"): allow("r"),
        },
        glob("$TMPDIR/**"): allow(),
    },
    net = allow(),
    doc = "Docker full: build, run, compose, push. Full project access, network enabled.",
)

docker = {tool("Bash"): {("docker", "docker-compose", "podman"): allow(sandbox = docker_full)}}