Network isolation
Tool container has no network access except allow-listed endpoints. Prevents data exfiltration.
Advertisement
File system isolation
Read-only root, writable /tmp scoped to the invocation. Cleaned after.
Advertisement
Capability limits
CPU + memory + time bounded. Runaway tool gets killed.