{"id":49889251,"url":"https://github.com/santhsecurity/procjail","last_synced_at":"2026-05-15T20:09:10.474Z","repository":{"id":346917633,"uuid":"1192194997","full_name":"santhsecurity/procjail","owner":"santhsecurity","description":"Process sandbox for untrusted code — Linux namespaces, firejail, bubblewrap, watchdog timeout","archived":false,"fork":false,"pushed_at":"2026-04-25T23:04:43.000Z","size":73,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-04-26T01:12:21.089Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://santh.dev","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/santhsecurity.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-03-26T01:28:25.000Z","updated_at":"2026-04-25T23:04:46.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/santhsecurity/procjail","commit_stats":null,"previous_names":["santhsecurity/procjail"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/santhsecurity/procjail","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/santhsecurity%2Fprocjail","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/santhsecurity%2Fprocjail/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/santhsecurity%2Fprocjail/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/santhsecurity%2Fprocjail/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/santhsecurity","download_url":"https://codeload.github.com/santhsecurity/procjail/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/santhsecurity%2Fprocjail/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33078187,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-15T20:05:40.333Z","status":"ssl_error","status_checked_at":"2026-05-15T20:05:38.672Z","response_time":103,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-05-15T20:09:09.739Z","updated_at":"2026-05-15T20:09:10.469Z","avatar_url":"https://github.com/santhsecurity.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# procjail\n\nRun untrusted code in a sandbox. procjail picks the best containment strategy available on the system (bubblewrap \u003e firejail \u003e unshare \u003e rlimits), strips secret environment variables, enforces timeouts, and reports resource usage.\n\nLinux only. procjail relies on Linux process isolation primitives and sandbox launchers such as `bubblewrap`, `firejail`, and `unshare`.\n\n```rust,no_run\nuse procjail::{SandboxConfig, SandboxedProcess};\nuse std::{fs, path::Path};\n\nlet config = SandboxConfig::builder()\n    .runtime(\"sh\")\n    .max_memory_mb(256)\n    .timeout_seconds(5)\n    .build();\n\nlet work_dir = std::env::temp_dir().join(\"procjail-readme-example\");\nfs::create_dir_all(\u0026work_dir)?;\n\nlet harness = work_dir.join(\"harness.sh\");\nfs::write(\n    \u0026harness,\n    \"#!/bin/sh\\nwhile IFS= read -r line; do printf '{\\\"echo\\\":%s}\\\\n' \\\"$line\\\"; done\\n\",\n)?;\n\nlet mut proc = SandboxedProcess::spawn(\n    Path::new(\u0026harness),\n    Path::new(\u0026work_dir),\n    \u0026config,\n)?;\n\nproc.send(\"42\")?;\nlet response = proc.recv()?;\nprintln!(\"{response:?}\");\n# Ok::\u003c(), procjail::ProcjailError\u003e(())\n```\n\n## Containment strategies\n\n| Strategy | PID isolation | Network | Filesystem | How |\n|----------|:---:|:---:|:---:|-----|\n| Bubblewrap | Yes | Yes | Full (ro-bind) | Recommended. Rootless. |\n| Firejail | Yes | Yes | Full (--private) | Adds seccomp + rlimits. |\n| Unshare | Yes | Yes | Partial (mount ns) | No full FS restriction. |\n| RlimitsOnly | No | No | No | Harness enforces limits. Last resort. |\n\nprocjail auto-detects which strategies work on the current system. Override with `.strategy(Strategy::Bubblewrap)`.\n\n## Secret stripping\n\n36 environment variables are stripped by default (AWS keys, GitHub tokens, database URLs, API keys). Custom additions via `.env_strip(\u0026[\"MY_SECRET\"])`. The passthrough list cannot re-add stripped secrets.\n\n## Resource reporting\n\n```rust\nlet usage = proc.wait_with_usage().unwrap();\nprintln!(\"peak memory: {} bytes\", usage.peak_memory_bytes);\nprintln!(\"cpu time: {:.2}s\", usage.cpu_time_secs);\nprintln!(\"killed by timeout: {}\", proc.killed_by_timeout);\n```\n\n## Contributing\n\nPull requests are welcome. There is no such thing as a perfect crate. If you find a bug, a better API, or just a rough edge, open a PR. We review quickly.\n\n## License\n\nMIT. Copyright 2026 CORUM COLLECTIVE LLC.\n\n[![crates.io](https://img.shields.io/crates/v/procjail.svg)](https://crates.io/crates/procjail)\n[![docs.rs](https://docs.rs/procjail/badge.svg)](https://docs.rs/procjail)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsanthsecurity%2Fprocjail","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsanthsecurity%2Fprocjail","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsanthsecurity%2Fprocjail/lists"}