The sandbox says what it refused

On Linux, the vx installed from npm could not find the sandbox’s helper.

A write the sandbox refused failed with the tool’s own error and no word from vx, and a task that swallowed the error passed.

This release puts the helper in the binary. Upgrade if you use exec.sandbox on Linux.

In this release

• The sandbox says what it refused

The sandbox says what it refused

The sandbox watches a task’s writes through a small helper program. A run of vx from source found it beside the sandbox runtime.

The published binary bundles that runtime without the helper’s file, so it ran with no watcher. This is 0.0.655 on a build with no write grant:

$ vx run build --all
┌─ packages/lib#build > failed (exit 1)
$ mkdir -p dist && cp src/a.txt dist/
├─ OUTPUT ────────────────────────────────────────────────────
mkdir: cannot create directory 'dist': Read-only file system
└─ packages/lib#build ── (51ms) failed (exit 1)

Now the helper is inside the binary, which copies it once to ~/.cache/vx/helpers/. The same build names the write and the grant:

$ vx run build --all
┌─ packages/lib#build > failed (exit 1, 1 sandbox violation)
$ mkdir -p dist && cp src/a.txt dist/
├─ OUTPUT ────────────────────────────────────────────────────
mkdir: cannot create directory 'dist': Read-only file system
├─ SANDBOX VIOLATIONS (1) ────────────────────────────────────
mkdir(/home/user/acme/packages/lib/dist) = a write no grant covers  [/home/user/acme/packages/lib/dist]
fix: exec.sandbox.allow: { write: ['dist/'] }
└─ packages/lib#build ── (61ms) failed (exit 1, 1 sandbox violation)

A task that hides its refused write (2>/dev/null; true) fails again, so nothing it half did is cached.

Unix sockets are blocked again too: without the helper, a sandboxed task could reach a socket such as Docker’s with no unixSockets grant.

See Sandboxing.

Other noteworthy changes

• A sandbox that declares no read in its project (sandbox: {}) offers read: ['.'] beside the one file a failed tool named.
• A sandboxed run no longer starts npm root -g to look for the helper.

How to update

vx upgrade