Crate heel 

Native Sandbox - Cross-platform native sandboxing library

This library provides a simple API for running untrusted code in a secure sandbox. It uses platform-native sandboxing mechanisms:

• macOS: sandbox-exec with SBPL profiles
• Linux: Landlock + Seccomp (planned)
• Windows: AppContainer (planned)

Example

use heel::Sandbox;

async fn run_sandboxed() -> heel::Result<()> {
    // Create a sandbox with default configuration (network denied)
    let sandbox = Sandbox::new()?;

    // Run a command in the sandbox
    let output = sandbox.command("echo")
        .arg("Hello from sandbox!")
        .output()
        .await?;

    println!("Output: {}", String::from_utf8_lossy(&output.stdout));
    Ok(())
}

Network Policies

By default, all network access is denied. You can configure network access using different policies:

• DenyAll - Deny all network access (default)
• AllowAll - Allow all network access
• AllowList - Allow access to specific domains
• CustomPolicy - Custom async handler for network decisions

Python Support

The library has built-in support for Python virtual environments:

use heel::{Sandbox, SandboxConfig, PythonConfig, VenvConfig};

async fn run_python() -> heel::Result<()> {
    let venv_config = VenvConfig::builder()
        .packages(["requests", "numpy"])
        .build();

    let config = SandboxConfig::builder()
        .python(PythonConfig::builder().venv(venv_config).build())
        .build()?;

    let sandbox = Sandbox::with_config(config)?;
    let output = sandbox.run_python("import requests; print(requests.__version__)").await?;
    Ok(())
}

Re-exports

pub use ipc::IpcCommand;

pub use ipc::IpcError;

pub use ipc::IpcRouter;

pub use rmp_serde;

Modules

ipc

Inter-Process Communication (IPC) for sandbox

Structs

AllowAll

Allow all network access

AllowList

Allow access to specific domains only

Child

A spawned child process in the sandbox

Command

A builder for sandboxed commands, similar to smol::process::Command

CustomPolicy

Custom async policy with user-provided handler function

DenyAll

Deny all network access (default policy)

DomainRequest

Information about a network access request

PythonConfig

Python sandbox configuration

PythonConfigBuilder

Builder for PythonConfig

ResourceLimits

Resource limits for sandboxed processes

ResourceLimitsBuilder

Builder for ResourceLimits

Sandbox

A sandbox for running untrusted code with restricted permissions

SandboxConfig

Main sandbox configuration

SandboxConfigBuilder

Builder for SandboxConfig

SecurityConfig

Static security configuration for sandbox profile generation

SecurityConfigBuilder

Builder for SecurityConfig

VenvConfig

Configuration for Python virtual environment

VenvConfigBuilder

Builder for VenvConfig

VenvManager

Manages a Python virtual environment

WorkingDir

Working directory for the sandbox

Enums

ConnectionDirection

Direction of a network connection

Error

Errors that can occur during sandbox operations

StdioConfig

Standard I/O configuration for a sandboxed command

Traits

NetworkPolicy

Async network policy trait - determines if a connection is allowed

Functions

python_data_science_preset

Create a sandbox config for Python data science with common tools

python_dev_preset

Create a sandbox config for Python development with pip install capability

strict_preset

Create a strict sandbox config with no network and minimal access

Type Aliases

Result

Result type for sandbox operations