CubeSandboxBackend class abstract interface

A platform strategy for confining a cube's processes at the OS level.

Implementers

• LinuxUnshareBackend
• MacOsSandboxBackend
• NoOpCubeBackend
• WindowsJobBackend

Properties

enforces → bool

Whether this backend actually confines at the OS level. false means wrapCommand is a passthrough and kernel mode degrades to the Dart policy layers.

no setter

hashCode → int

The hash code for this object.

no setter, inherited

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

Methods

describe() → String

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

toString() → String

A string representation of this object.

inherited

wrapCommand(String command, {required String profilePath, Map<String, String> env = const {}}) → String

Wraps command so it runs inside the OS sandbox. profilePath names the content-verified profile file staged by the shell (<home>/.fah/cube-profiles/); implementations that confine by other means may ignore it. env carries the caller's per-exec environment (ShellExecOptions.env): kernel wrapping must thread it into the clean child environment or session vars and secrets are silently dropped — entries override the backend's cube-bound vars. Implementations that change nothing may ignore it too.

Operators

operator ==(Object other) → bool

The equality operator.

inherited