Home
Python
TSsandlock is the local Python runtime with a
fence around it: the same host CPython, native wheels, and exact sys.flags,
but spawned through Sandlock. A
Landlock ruleset and seccomp filter bound where its I/O can land.
Sandlock is Python-only in Mirage today. This is not a fundamental
Sandlock restriction. The current adapter was implemented against Mirage’s
Python interpreter runtime; a TypeScript adapter around the same Sandlock CLI
has not landed yet. Sandlock appears under Sandbox for discoverability,
but it confines
python3 rather than capturing arbitrary command lines like
Docker, smolvm, Daytona, and E2B.Configure
Nothing is granted except the interpreter’s own tree, the system paths CPython needs to start, and the paths you list:sandlock CLI on PATH; there is no Mirage extra to install
because the CLI is the transport. Sandlock is Linux only, and its full
ruleset wants Landlock ABI v6 (Linux 6.12+). Sandlock’s degrade options cover
older kernels with weaker protection.
The optional home config chooses a different Python interpreter. It accepts
an executable path or command name, then falls back to
MIRAGE_SANDLOCK_HOME and the interpreter running Mirage.
Workspace access
Sandlock hasprocess reach, the same as local. Confinement narrows which
host paths the code can touch, but the workspace gate never sees that I/O, so
mount modes, policy, and accounting do not apply to it.
Point fs_writable at a FUSE-mounted workspace path to
let confined code work on your mounts while reaching nothing else on the host.
Without FUSE, Sandlock code does not see Mirage’s virtual workspace mounts.
Environment
The runtime deliberately does not inherit the Mirage process environment. Only the configenv and the run’s own environment are set, so confined code
is not handed the backend credentials Mirage is holding. Name every variable
the interpreter needs: