Repository navigation

feat(sandbox): enforce egress with a privileged agent (ALIEN-1188) - #840

Merged

alongubkin merged 10 commits into

mainfrom

islo/alien-1188-sandboxes-privileged-supervisor-unprivileged-commands

Oct 3, 2026

Merged

feat(sandbox): enforce egress with a privileged agent (ALIEN-1188)#840
alongubkin merged 10 commits into
mainfrom
islo/alien-1188-sandboxes-privileged-supervisor-unprivileged-commands

Commits on Oct 3, 2026
- feat(sandbox): add agent-owned privileged egress enforcement
  
  alongubkin
  and
  claude
  committed
  9a4c186
- fix(sandbox): harden supervisor bootstrap and command isolation
  
  alongubkin
  and
  claude
  committed
  d51756d
- fix(sandbox): preserve default emitter environment ordering
  
  alongubkin
  and
  claude
  committed
  2841035
- fix: harden supervised egress and qualify command isolation
  
  alongubkin
  and
  claude
  committed
  a745258
- test: supply sandbox declaration to terraform environment helper
  
  alongubkin
  and
  claude
  committed
  92effb6
- fix: permit tcp ingress replies without guest conntrack
  
  alongubkin
  and
  claude
  committed
  a748242
- test: verify commands cannot forge tcp reply traffic
  
  alongubkin
  and
  claude
  committed
  207ce1c
- fix: scope native nftables egress to the declared command uid
  
  alongubkin
  and
  claude
  committed
  7fbf45c
- test: qualify unprivileged preview replies across the docker bridge
  
  alongubkin
  and
  claude
  committed
  09e5f78
- docs: describe address pinning across image restore
  
  alongubkin
  and
  claude
  committed
  c6403fa