v0.3.0

nsjail-python v0.3.0

Seccomp Policy Helpers

Build seccomp policies in Python instead of writing raw Kafel:

from nsjail import Jail, MINIMAL, SeccompPolicy

# Use a preset
cfg = Jail().sh("echo hi").seccomp(MINIMAL).build()

# Or build a custom policy
policy = (
    SeccompPolicy("custom")
    .allow("read", "write", "close", "exit_group")
    .deny("execve", "fork")
    .default_kill()
)
cfg = Jail().sh("echo hi").seccomp(policy).build()

Presets: MINIMAL, DEFAULT_LOG, READONLY
Builder methods: .allow(), .deny(), .errno(), .log(), .trap()

Cgroup Stats Recovery

Capture resource usage stats during sandbox execution:

from nsjail import Runner

runner = Runner(
    base_config=cfg,
    collect_cgroup_stats=True,
)
result = runner.run()

if result.cgroup_stats:
    print(f"Peak memory: {result.cgroup_stats.memory_peak_bytes}")
    print(f"CPU time: {result.cgroup_stats.cpu_usage_ns}ns")
    print(f"Processes: {result.cgroup_stats.pids_current}")

Supports both cgroup v1 and v2. Uses a background monitor thread to capture stats before nsjail cleans up cgroups.