Supported compiler isolation on GitHub-hosted Ubuntu 24.04 #211899
Unanswered
jakrabbit5113
asked this question in
Actions
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
🏷️ Discussion Type
Question
💬 Feature/Topic Area
Actions Runner
Discussion Details
What documented, supported mechanism can isolate an untrusted Node compiler from supervisor credentials, files, processes and privileged sockets; keep inputs read-only; enforce an outbound network allowlist; terminate all compiler descendants; and let the supervisor exclusively capture outputs afterward? Please identify limitations and a reproducible verification method that needs no secrets.
All reactions