SandboxProfile

Schema string enum

Versioned seccomp policy. v2 profiles are allowlists (an unlisted syscall fails with ENOSYS); v1 profiles are denylists. compile_* tasks may create processes and namespace-scoped sockets (compilers, interpreters, build tools); native_* tasks may do neither (running a compiled submission). A denied syscall kills the task with SIGSYS and outcome policy_violation.

Values

• compile_v2
• native_v2
• compile_v1
• native_v1

Used by

• GET /info Service capabilities and effective limits
• POST /execute Run a sequence of steps in one sandbox

Referenced by Task , ServiceInfo .