# ExSandbox v1.2.0 - Table of Contents

> Isolated execution sandboxes: a composition and evidence layer over operating-system containment facilities, which refuses to run rather than confine partially.

## Pages

- [ExSandbox](readme.md)
- [Changelog](changelog.md)
- [Requirement IDs](requirement-ids.md)
- [Why this library cites documents that are not in it](provenance.md)
- [The public interface of ex_sandbox](boundary.md)

## Modules

- [ExSandbox.LoopFormatter](ExSandbox.LoopFormatter.md): An `ExUnit` formatter that writes a machine-readable per-test report.
- [ExSandbox.Mechanism.Beam.Exec](ExSandbox.Mechanism.Beam.Exec.md): Builds the expression that runs one command **inside** a BEAM sandbox, and
decodes what comes back (008 T002, T003).
- [ExSandbox.Mechanism.Beam.NodeLauncher](ExSandbox.Mechanism.Beam.NodeLauncher.md): Starts, probes, and terminates one hardened sandbox node (005 T020-T026).
- [ExSandbox.Proxy](ExSandbox.Proxy.md): Forwards a request to a running sandbox's address (012 T041, contracts/boundary.md).
- [ExSandbox.Telemetry](ExSandbox.Telemetry.md): Events both libraries emit, carrying the opaque `owner_ref` (012 T043).

- Interface
  - [ExSandbox](ExSandbox.md): Isolated execution sandboxes, as a library with no host-application concepts.
  - [ExSandbox.Capability](ExSandbox.Capability.md): What this library needs from its host, and whether it is actually there
(012 T013, T022, FR-016).
  - [ExSandbox.Mechanism](ExSandbox.Mechanism.md): The behaviour every isolation mechanism implements (012 T019, T020).
  - [ExSandbox.Sandbox](ExSandbox.Sandbox.md): The struct every `ExSandbox.Mechanism` callback receives (012 T012).

- Mechanisms
  - [ExSandbox.Mechanism.Beam](ExSandbox.Mechanism.Beam.md): Runs a tenant's Elixir application on its own hardened OS-level BEAM node
(005 T027).
  - [ExSandbox.Mechanism.Docker](ExSandbox.Mechanism.Docker.md): A sandbox is one container, managed through the `docker` CLI.

- Conformance
  - [ExSandbox.Conformance](ExSandbox.Conformance.md): The conformance suite every mechanism is held to (012 T030–T035, FR-010).
  - [ExSandbox.Conformance.CapabilityUnavailable](ExSandbox.Conformance.CapabilityUnavailable.md): The suite's third outcome (012 T034).
  - [ExSandbox.Conformance.Census](ExSandbox.Conformance.Census.md): Separates the suite's third outcome from failure **in the exit status**
(`012-FR-016a`).
  - [ExSandbox.Conformance.Credentials](ExSandbox.Conformance.Credentials.md): Conformance group: a sandbox's credential reaches its own store and nothing
else (003 T030–T033, `FR-018` – `FR-021`, quickstart Scenario 4).
  - [ExSandbox.Conformance.Credentials.Probe](ExSandbox.Conformance.Credentials.Probe.md): What a host supplies so the credentials group can attempt real connections.
  - [ExSandbox.Conformance.Execution](ExSandbox.Conformance.Execution.md): Conformance group: running a command inside a sandbox (008 T005).
  - [ExSandbox.Conformance.Group](ExSandbox.Conformance.Group.md): Emits one conformance check as an ExUnit test (012 T034).
  - [ExSandbox.Conformance.Helpers](ExSandbox.Conformance.Helpers.md): The shared vocabulary of the conformance suite (012 T033, T034, T034b).
  - [ExSandbox.Conformance.Isolation](ExSandbox.Conformance.Isolation.md): Conformance group: isolation (012 T031; `003` quickstart Scenario 1).
  - [ExSandbox.Conformance.Lifecycle](ExSandbox.Conformance.Lifecycle.md): Conformance group: the sandbox lifecycle (012 T032; `003-FR-010`, `003-FR-013`).
  - [ExSandbox.Conformance.Network](ExSandbox.Conformance.Network.md): Conformance group: network confinement (005 T060b, T060d; `003-FR-002`,
`005-FR-003`, `005-FR-011a`–`FR-011d`).
  - [ExSandbox.Conformance.Reachability](ExSandbox.Conformance.Reachability.md): Conformance group: the states a request to a sandbox can land in
(003 T021, `FR-022` – `FR-024`, quickstart Scenario 5).
  - [ExSandbox.Conformance.Reconciliation](ExSandbox.Conformance.Reconciliation.md): Conformance group: what a mechanism must provide for reconciliation to be
possible at all (003 T022, `FR-015`, `SC-008`, quickstart Scenario 6).
  - [ExSandbox.Conformance.ResourceLimits](ExSandbox.Conformance.ResourceLimits.md): Conformance group: resource limits (012 T034a, T034b; `FR-012a`, `SC-008`).

- Hardening
  - [ExSandbox.Hardening](ExSandbox.Hardening.md): The OS-level enforcement seam (012 T021, from `005`'s `contracts/hardening.md`).
  - [ExSandbox.Hardening.Confinement](ExSandbox.Hardening.Confinement.md): Confines a **control-plane** process to one filesystem path (015 T107, from
research R16 and R30).
  - [ExSandbox.Hardening.Darwin](ExSandbox.Hardening.Darwin.md): OS-level confinement for the BEAM mechanism on macOS (014 T011 – T015, from
`005` R9b and `014`'s re-measurement at
`docs/legacy/specify/014-desktop-deployment/spikes/darwin-hardening/baseline.md`).
  - [ExSandbox.Hardening.Linux](ExSandbox.Hardening.Linux.md): OS-level confinement for the BEAM mechanism on Linux (005 T004 – T012,
contracts/hardening.md, research R2, R3, R9).

- Egress
  - [ExSandbox.Egress.Acceptor](ExSandbox.Egress.Acceptor.md): The listener that lives inside one sandbox's network namespace
(005 T060a1/T060a3, `contracts/egress.md`).
  - [ExSandbox.Egress.Allocator](ExSandbox.Egress.Allocator.md): Hands out the `/30` a sandbox's netns is built on, and takes it back only
when the sandbox's policy is gone (005 T060a3, `contracts/egress.md`).
  - [ExSandbox.Egress.Allowlist](ExSandbox.Egress.Allowlist.md): Turns a tenant project's configured destinations into the form
`ExSandbox.Egress.Policy` enforces (005 T060a2, `013-FR-014b`).
  - [ExSandbox.Egress.Binding](ExSandbox.Egress.Binding.md): Ties one sandbox's resolved allowlist to the `/30` its traffic arrives from,
and takes both back together (005 T060a2/T060a6, `005-FR-011a`–`FR-011e`).
  - [ExSandbox.Egress.ByteProbe](ExSandbox.Egress.ByteProbe.md): The `029-FR-016` instrument: **did any bytes cross?**
  - [ExSandbox.Egress.Decision](ExSandbox.Egress.Decision.md): The single implementation of "may this sandbox reach this destination"
(005 T060a1/T060a3, `contracts/egress.md`).
  - [ExSandbox.Egress.HostAliases](ExSandbox.Egress.HostAliases.md): Every address that **is this host**, as this host currently reports itself
(029 T014's supply half, `029-FR-015`, D103).
  - [ExSandbox.Egress.LaunchPlan](ExSandbox.Egress.LaunchPlan.md): The ordered steps that put a tenant process inside a policed namespace
(005 T060a3, `contracts/egress.md` §Lifecycle).
  - [ExSandbox.Egress.Netns](ExSandbox.Egress.Netns.md): The commands that turn a sandbox's network namespace into its only path out
(005 T060a3, `contracts/egress.md`).
  - [ExSandbox.Egress.NetnsSocket](ExSandbox.Egress.NetnsSocket.md): Sockets created inside a sandbox's network namespace and owned by this BEAM.
  - [ExSandbox.Egress.OriginalDst](ExSandbox.Egress.OriginalDst.md): Recovers the destination a sandbox's connection was *originally* aimed at,
before the netns redirect sent it to the pool (005 T060a3,
`contracts/egress.md`).
  - [ExSandbox.Egress.Pasta](ExSandbox.Egress.Pasta.md): Finds the process that actually holds a sandbox's network namespace
(005 T060a3, `contracts/egress.md`).
  - [ExSandbox.Egress.Policy](ExSandbox.Egress.Policy.md): Which destinations one sandbox may reach, and how that sandbox is identified
(005 T060a1/T060a2, `contracts/egress.md`, `005-FR-011a`–`FR-011e`).
  - [ExSandbox.Egress.Registry](ExSandbox.Egress.Registry.md): Holds each running sandbox's egress policy, keyed by its source /30
(005 T060a1/T060a6, `005-FR-011a`–`FR-011e`).
  - [ExSandbox.Egress.Relay](ExSandbox.Egress.Relay.md): Forwards a **permitted** connection to its destination (005 T060a9,
`contracts/egress.md`).
  - [ExSandbox.Egress.Resolver](ExSandbox.Egress.Resolver.md): The platform's DNS service for sandboxes (029 T015, `029-FR-013`,
`029-FR-012`, `029-FR-015`).
  - [ExSandbox.Egress.Verification](ExSandbox.Egress.Verification.md): Whether a running sandbox is *policed* rather than merely *isolated*
(005 T060a3/T060a5, `contracts/egress.md` §Capability probing).