visor/sandboxexec/proto/sandbox_options.proto

// Copyright 2026 The gVisor Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package cloud_gvisor_sandboxexec;

message SandboxOptions {
  repeated Mount mounts = 1;

  NetworkingOptions networking_options = 2;

  string stdout_file = 3;
  string stderr_file = 4;

  repeated EnvVar env_vars = 5;

  DebugOptions debug_options = 6;

  int64 start_timeout_ms = 7;
}

message NetworkingOptions {
  bool enable_external_networking = 1;
  repeated PortMapping port_mappings = 2;
  repeated string domain_allowlist = 3;
  repeated string domain_denylist = 4;
}

message DebugOptions {
  string enable_debug_logs = 1;
  string debug_log_file = 2;
}

message EnvVar {
  string name = 1;

  enum EnvVarPolicy {
    ENV_VAR_POLICY_UNSPECIFIED = 0;
    ENV_VAR_POLICY_FORWARD = 1;
    ENV_VAR_POLICY_UNSET = 2;
  }
  oneof policy_or_value {
    string value = 2;
    EnvVarPolicy policy = 3;
  }
}

message PortMapping {
  uint32 sandbox_port = 1;
  uint32 host_port = 2;

  enum PortMappingType {
    PORT_MAPPING_TYPE_TCP = 0;
    PORT_MAPPING_TYPE_UDP = 1;
  }
  PortMappingType port_mapping_type = 3;
}

message MountOptions {
  // By default, host mounts are structured as an overlay. If passthrough is
  // enabled, the host path is mounted directly into the sandbox and writes
  // persist to the host.
  bool passthrough = 1;
}

message Mount {
  string target = 1;
  oneof mount {
    HostMount host_mount = 2;
    SandboxTmpfsMount sandbox_tmpfs_mount = 3;
  }
}

message HostMount {
  string host_path = 1;
  MountOptions options = 2;
}

message SandboxTmpfsMount {}