-
Notifications
You must be signed in to change notification settings - Fork 0
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
VERIFY.md is 8032 lines nothing executes: convert its checks into numbered scripts/ and run them in CI
area:docsDocumentation and design recordsDocumentation and design recordsarea:testsCommitted suite, goldens, coverage gapsCommitted suite, goldens, coverage gapsenhancementNew feature or requestNew feature or requestStatus: Open.#589 In gomoni/snug;Investigate a Zypak-style broker: let a sandboxed app ask snug for a stricter sandbox
area:supervisorThe stage, process topology, teardownThe stage, process topology, teardownenhancementNew feature or requestNew feature or requestquestionFurther information is requestedFurther information is requestedStatus: Open.#584 In gomoni/snug;- Status: Open.#557 In gomoni/snug;
Research: what would Landlock add on top of bwrap + seccomp, and what would it cost
area:policyPolicy model, profiles, resolution, bwrap argvPolicy model, profiles, resolution, bwrap argvenhancementNew feature or requestNew feature or requestquestionFurther information is requestedFurther information is requestedStatus: Open.#551 In gomoni/snug;Idea: snug-in-snug — run a command in a stricter sandbox from inside a sandbox
area:supervisorThe stage, process topology, teardownThe stage, process topology, teardownenhancementNew feature or requestNew feature or requestquestionFurther information is requestedFurther information is requestedStatus: Open.#509 In gomoni/snug;Research: can systemd-nsresourced replace the /etc/subuid + newuidmap requirement for the engine's stage?
area:supervisorThe stage, process topology, teardownThe stage, process topology, teardownenhancementNew feature or requestNew feature or requestquestionFurther information is requestedFurther information is requestedStatus: Open.#482 In gomoni/snug;Idea, needs research: a profile cannot bind whichever host path exists AND point a variable at it
area:policyPolicy model, profiles, resolution, bwrap argvPolicy model, profiles, resolution, bwrap argvenhancementNew feature or requestNew feature or requestquestionFurther information is requestedFurther information is requestedStatus: Open.#477 In gomoni/snug;@http-proxy needs a staged adapter for servers that only bind a port (Java, .NET, containers)
area:proxyThe podman socket proxy and build filterThe podman socket proxy and build filterenhancementNew feature or requestNew feature or requestStatus: Open.#476 In gomoni/snug;Research: /login inside the sandbox — the callback, the browser, and what must not become a refresh token
area:identityssh/git/gh identity pinning, the agent proxyssh/git/gh identity pinning, the agent proxyenhancementNew feature or requestNew feature or requestquestionFurther information is requestedFurther information is requestedStatus: Open.#455 In gomoni/snug;Idea: bound the sandbox's memory with a cgroup v2 memory.max, because --size bounds each mount and not their sum
enhancementNew feature or requestNew feature or requestStatus: Open.#283 In gomoni/snug;- Status: Open.#174 In gomoni/snug;
Open question: can the staged access token's user:mcp_servers scope write server-side state that outlives the token?
area:identityssh/git/gh identity pinning, the agent proxyssh/git/gh identity pinning, the agent proxyquestionFurther information is requestedFurther information is requestedsev:mediumConfirmed finding, medium severityConfirmed finding, medium severityStatus: Open.#141 In gomoni/snug;