This project is an OS-level process sandbox and cross-platform security wrapper for Linux and macOS. It is designed to isolate arbitrary processes from the host machine by restricting filesystem and network access without the use of full containerization.
The system functions as a system-call interceptor and access controller, blocking unauthorized operating system calls based on predefined security policies. It employs allowlists and denylists to manage resource requests and monitors for security violations in real time.
Capability areas include filesystem access management using glob-pattern filtering, network traffic filtering via external proxies for deep packet inspection, and the blocking of local Unix socket creation. These features allow for the execution of untrusted code or agents within restricted security boundaries.