This change refactors how network isolation is configured in both the Go and
Python sandbox APIs. Instead of a boolean enable/disable flag, a new
NetworkMode enum (supporting "none", "host", and "sandbox") is introduced.
PiperOrigin-RevId: 967507724
Add support for custom directory mounts (bind mounts, in-memory tmpfs mounts,
and procfs mounts) to the Python SandboxExec bindings (gvisor.sandbox).
Features introduced:
- Mount dataclass with factory methods:
Mount.bind(source, destination, readonly=False),
Mount.tmpfs(destination), and Mount.proc(destination).
- MountType enum supporting 'bind', 'tmpfs', and 'proc'.
- _normalize_mounts private module-level helper function to validate and
normalize mount configurations from Mount instances or dictionary
definitions.
- mounts parameter in Sandbox.__init__ to configure container mounts in OCI
config.json spec.
- Exported Mount and MountType in gvisor package root.
- Comprehensive unit and integration tests covering read-only bind mounts,
read-write bind mounts, tmpfs, proc mounts, dictionary configuration,
validation error cases, and Mount factory methods.
PiperOrigin-RevId: 964427990
Add support for configuring the container working directory and per-command
working directory overrides in the Python SandboxExec bindings (gvisor.sandbox).
Features introduced:
- Added working_dir parameter to Sandbox.__init__ to configure the initial
working directory inside the container (written to spec.process.cwd in
config.json). Defaults to "/".
- Added _normalize_working_dir private module-level helper to normalize and
validate working directory paths into absolute POSIX paths.
- Added cwd parameter to Sandbox.exec to support per-command execution directory
overrides via the '--cwd' flag passed to runsc exec.
- Added comprehensive unit test coverage for default/unset working_dir, custom
paths, relative path normalization, invalid values, and exec cwd overrides.
PiperOrigin-RevId: 963705877
