Module sandboxing 

Sandboxing module for VT Code

This module provides sandbox policies and execution environment transformations inspired by the OpenAI Codex execution model and the AI sandbox field guide. It enables safe command execution with configurable isolation levels.

Architecture

The sandboxing system implements the field guide’s three-question model:

• Boundary: What is shared (kernel-enforced via Seatbelt/Landlock)
• Policy: What can code touch (SandboxPolicy enum)
• Lifecycle: What survives between runs (session-scoped approvals)

Key components:

• SandboxPolicy: Configurable isolation levels (ReadOnly, WorkspaceWrite, DangerFullAccess)
• SandboxManager: Transforms command specifications into sandboxed execution environments
• SandboxPermissions: Fine-grained permission control for individual operations
• NetworkAllowlistEntry: Domain-based network egress control
• SensitivePath: Credential location blocking
• ResourceLimits: Memory, PID, disk, and CPU limits

Usage

use vtcode_core::sandboxing::{SandboxPolicy, SandboxManager, CommandSpec, ResourceLimits};

let policy = SandboxPolicy::read_only();
let manager = SandboxManager::new();
let spec = CommandSpec {
    program: "cat".to_string(),
    args: vec!["file.txt".to_string()],
    ..Default::default()
};

// Transform to sandboxed environment
let exec_env = manager.transform(spec, &policy, std::path::Path::new("/tmp"), None)?;

Structs

AdditionalPermissions

Additional per-command filesystem permissions.

CommandSpec

Specification for a command to be executed.

ExecEnv

The prepared execution environment after sandbox transformation.

NetworkAllowlistEntry

Network allowlist entry for domain-based egress control.

ResourceLimits

Resource limits for sandboxed execution.

SandboxDebugResult

Result of a sandbox debug test.

SandboxManager

Manager for sandbox transformation.

SeccompProfile

Seccomp profile configuration for Linux sandboxing.

SensitivePath

Sensitive path entry for blocking access to credential locations.

WritableRoot

A root directory that may be written to under the sandbox policy.

Enums

DebugSubcommand

Debug subcommand types for CLI integration.

ExecExpiration

Mechanism to terminate an exec invocation before it finishes naturally.

SandboxPermissions

Fine-grained permissions for sandbox operations.

SandboxPolicy

Sandbox policy determining what operations are permitted during execution.

SandboxTransformError

Error type for sandbox transformation failures.

SandboxType

Type of sandbox being used.

Constants

BLOCKED_SYSCALLS

Syscalls that should be blocked in seccomp-bpf profiles.

DEFAULT_SENSITIVE_PATHS

Default sensitive paths that should be blocked from sandboxed processes.

FILTERED_ENV_VARS

Environment variables that should be filtered from sandboxed processes.

FILTERED_SYSCALLS

Syscalls that require argument filtering (not fully blocked).

PRESERVED_ENV_VARS

Environment variables that should always be preserved.

VTCODE_SANDBOX_ACTIVE

Sandbox environment markers set for child processes.

VTCODE_SANDBOX_NETWORK_DISABLED

VTCODE_SANDBOX_TYPE

VTCODE_SANDBOX_WRITABLE_ROOTS

Functions

build_sanitized_env

Build a sanitized environment for sandboxed child processes.

debug_sandbox

Debug sandbox configuration by running a test command.

default_sensitive_paths

Get the default sensitive paths as SensitivePath entries.

filter_sensitive_env

Filter sensitive environment variables from an existing map.

sandbox_capabilities_summary

Get a human-readable summary of sandbox capabilities for the current platform.

setup_parent_death_signal

Set up parent death signal on Linux.

should_filter_env_var

Check if an environment variable should be filtered.

test_network_blocked

Test if network access is blocked under the given sandbox policy.

test_path_writable

Test if a specific path is writable under the given sandbox policy.