This change refactors how network isolation is configured in both the Go and
Python sandbox APIs. Instead of a boolean enable/disable flag, a new
NetworkMode enum (supporting "none", "host", and "sandbox") is introduced.
PiperOrigin-RevId: 967507724
Add support for custom directory mounts (bind mounts, in-memory tmpfs mounts,
and procfs mounts) to the Python SandboxExec bindings (gvisor.sandbox).
Features introduced:
- Mount dataclass with factory methods:
Mount.bind(source, destination, readonly=False),
Mount.tmpfs(destination), and Mount.proc(destination).
- MountType enum supporting 'bind', 'tmpfs', and 'proc'.
- _normalize_mounts private module-level helper function to validate and
normalize mount configurations from Mount instances or dictionary
definitions.
- mounts parameter in Sandbox.__init__ to configure container mounts in OCI
config.json spec.
- Exported Mount and MountType in gvisor package root.
- Comprehensive unit and integration tests covering read-only bind mounts,
read-write bind mounts, tmpfs, proc mounts, dictionary configuration,
validation error cases, and Mount factory methods.
PiperOrigin-RevId: 964427990
