 Kronecker
|
9bb27f2e02
|
feat(sandbox): install profile seccomp with ABI and inheritance checks
|
2026-10-07 19:16:20 +08:00 |
|
|
Kronecker
|
46714bd9ea
|
feat(sandbox): lease task identities and drop initialization privileges
|
2026-10-07 18:22:58 +08:00 |
|
|
Kronecker
|
329c9222a3
|
feat(sandbox): bind readonly inputs through authenticated capabilities
|
2026-10-07 17:57:10 +08:00 |
|
|
Kronecker
|
9a2b1c071f
|
feat(sandbox): snapshot artifacts through bounded file capabilities
|
2026-10-07 16:19:05 +08:00 |
|
|
Kronecker
|
2b5e79dd39
|
feat(sandbox): restrict proc and devices in private roots
|
2026-10-07 13:21:37 +08:00 |
|
|
Kronecker
|
0f68eb5fb0
|
feat(sandbox): build private read-only roots with pivot_root
|
2026-10-07 10:02:21 +08:00 |
|
|
Kronecker
|
f22308080f
|
feat(sandbox): initialize isolated namespaces through gated helpers
|
2026-10-07 04:16:11 +08:00 |
|
|
Kronecker
|
1a91c2e0f6
|
feat(sandbox): gate target startup with verified task cgroups
|
2026-10-07 01:40:32 +08:00 |
|
|
Kronecker
|
605785edee
|
test(sandbox): allow launcher checks in independent VMs
|
2026-10-07 01:09:50 +08:00 |
|
|
Kronecker
|
08db00b56e
|
feat(sandbox): add bounded standalone launcher control
|
2026-10-06 22:04:29 +08:00 |
|
|
Kronecker
|
957135a112
|
feat(sandbox): enforce launcher lifecycle ordering
|
2026-10-06 11:02:55 +08:00 |
|
|
Kronecker
|
1f45266517
|
feat(sandbox): define runtime policy and preflight refusals
|
2026-10-06 03:58:19 +08:00 |
|
|
Kronecker
|
ee1f43a4cb
|
feat(sandbox): model execution outcomes and limit attribution
|
2026-10-06 01:00:04 +08:00 |
|
|
Kronecker
|
7ef77dfb34
|
feat(sandbox): validate bounded local execution specifications
|
2026-10-05 22:04:59 +08:00 |
|
|
Kronecker
|
b5b286c44f
|
chore(workspace): bootstrap platform, judge and frontend
|
2026-10-04 15:46:49 +08:00 |
|