sota-sandboxing

You can isolate untrusted code execution by defining secure boundaries using VMs, microVMs, containers, and user-space kernels, which this skill configures to safeguard against potential breaches during processing.

The best way to secure untrusted inputs is through isolation layering, stacking multiple boundary types like gVisor and Kata to provide defense-in-depth against different types of attacks during execution.

You create a sandbox with gVisor and set resource limits by executing the `sota-sandboxing create sandbox` command, specifying the boundary type and allocating CPU and memory constraints to restrict execution.

Yes, this sandboxing approach works with kernel mechanisms like seccomp, landlock, AppArmor, and SELinux, requiring these and container features to enforce robust isolation boundaries for untrusted code.

You need a microVM boundary like Firecracker instead of a standard container when executing highly untrusted code that requires stronger hardware-level isolation, utilizing defense-in-depth strategies to prevent severe attacks.

You audit and verify your sandbox configuration by conducting comprehensive verification checks provided by the skill, ensuring the isolation layers and boundary enforcement mechanisms are effectively securing the environment.