Linux: Make the Sandbox Layers Observable

This exact address is preserved because technical sources still link to it. This is new independent material. The site is not the original CloudABI project, does not distribute a CloudABI Linux runtime, and does not claim compatibility with the former implementation.

Linux confinement is usually a stack of mechanisms. A namespace changes what a process can see. A cgroup constrains resources and accounts for use. A system-call filter limits selected calls. Filesystem mount choices change reachable names. User and capability settings change permitted operations. No single layer describes the whole boundary.

Write one control matrix

List each desired restriction and the mechanism that enforces it. Add the configuration source, applied value, verification command, and negative test. If two mechanisms enforce one rule, record both. If a rule has no enforcement, label it as an assumption.

A useful matrix covers:

1. user and group identity;
2. Linux capability sets;
3. mount, PID, network, user, and IPC namespaces;
4. available file descriptors;
5. system-call filter policy;
6. cgroup memory, CPU, process, and I/O controls;
7. executable and writable mount relationships;
8. device access; and
9. audit and termination signals.

Use the Linux kernel documentation for current subsystem behavior. Store the kernel version because a feature name alone does not establish identical support or defaults across deployments.

Test the effective state

Configuration files describe intent. The running process provides evidence. Inspect the effective namespace identifiers, capability sets, cgroup membership, open descriptors, mounts, and filter state after startup. Repeat the check for child processes.

Do not assume that a container image defines the boundary. The runtime, host kernel, launch options, and orchestrator policy all matter. Two deployments of the same image can expose different authority.

Treat descriptors as authority

A process can remain powerful inside restrictive namespaces if it inherits a descriptor to a sensitive file, directory, socket, or device. Capture the descriptor table at the start of steady-state work. Explain every entry. Verify close-on-exec behavior where a child process is possible.

If the supervisor prepares resources, give each handle a purpose and lifetime. A worker that only writes one result should not inherit a general directory handle. A connected socket can be safer than permission to create arbitrary outbound connections, but its peer and protocol still need validation.

Make failure useful

Negative tests must distinguish policy denial from an application defect. Store the attempted operation, expected block, observed error, kernel and runtime versions, and relevant audit event. An application that crashes because a denied call was not handled has failed the boundary test even when the kernel restriction worked.

Test startup, steady state, child creation, resource exhaustion, cancellation, and shutdown. Confirm that logging does not require new authority after confinement begins.

The result should be a reproducible Linux boundary statement, not a generic security claim. Historical CloudABI material can show why explicit runtime contracts matter. Current Linux evidence must show what the deployed process can actually do.