Sandbox

Sandbox

Edge adaptation of the upstream process sandbox and file-effect policy system.

Upstream reference: Sandbox

What Upstream Provides

The sandbox subsystem wraps subprocess arguments in file-effect policies. It operates at three layers:

• dsh-sandbox — abstract seam defining ctx.sandbox.confine(argv, policy) and the escalation vocabulary. Three file-effect modes: read-only, workspace-write, danger-full-access.
• dsh-sandbox-local — platform-specific implementations: Linux bwrap/Landlock, macOS Seatbelt, Windows ACL tokens.
• Consumers — dsh-bash-sandbox and dsh-pwsh-sandbox wrap shell commands through the sandbox before execution.

The sandbox also provides canonicalPath() (resolves symlinks via node:fs.realpathSync) and writableRoots() (computes allowed write directories including os.tmpdir()).

What Edge Changed

Patch Remove Node.js imports

The dsh-sandbox package imports node:fs (realpathSync) and node:os (tmpdir), which are unavailable in Cloudflare Workers. Edge applies a version-bound patch that makes two changes:

• canonicalPath(path) — returns the path directly instead of calling realpathSync.native(). VFS has no symlinks, so resolution is identity.
• writableRoots(policy) — omits the tmpdir() call. The writable roots are the workspace root and /tmp only.

No sandbox service installed

Edge does not install the ctx.sandbox service or any sandbox backend (dsh-sandbox-local). The patch is applied so that other upstream packages that import from dsh-sandbox (like the filesystem layer) can load without crashing on node:fs / node:os imports.

EdgeFileSystem reports sandboxMode as undefined, indicating no sandbox enforcement. The Cloudflare Workers isolate provides its own security boundary — code runs in a V8 isolate with no filesystem access beyond the Computer VFS, which is workspace-scoped by construction.

What Edge Did NOT Change

• The sandbox escalation vocabulary and approval choreography
• The SandboxPolicy resolution chain
• The ConfinedArgv result classification (denial signatures, runner failure rules)

Security Model Comparison

Aspect	Upstream (Node.js)	Edge (Workers)
Process isolation	bwrap/Landlock/Seatbelt/ACL per command	V8 isolate — no native processes
Filesystem scope	File-effect policy per subprocess	VFS workspace-scoped by construction
Write restriction	Configurable per-command via sandbox modes	All writes go through VFS — workspace only
Symlink resolution	realpathSync.native()	Identity — VFS has no symlinks

Architecture Summary

Component	Category	Edge Code
dsh-sandbox seam	Patched	Remove node:fs/node:os imports (6-line patch)
Sandbox service	Not installed	V8 isolate + VFS provide equivalent boundary
EdgeFileSystem.sandboxMode	Override	Returns undefined — no process-level sandbox

Key observation: The upstream sandbox exists to confine native subprocesses. Edge has no native subprocesses — just-bash runs in-process, and VFS is workspace-scoped by construction. The patch exists solely to prevent node:fs/node:os import crashes, not to provide sandbox functionality. If Cloudflare Containers are adopted for real subprocess execution, the sandbox seam would need a Container-aware backend instead of the current no-op.

TODO

Evaluate Container-aware sandbox backend. If subprocess support via Cloudflare Containers is implemented (#98), the sandbox seam should be wired with a Container-level confinement backend rather than remaining a no-op. The upstream ctx.sandbox.confine() API would apply file-effect policies to Container-spawned processes.