How can i restrict access to certain files and directories?

[yadavan88]

Hi,
I am trying to restrict access to ~/.ssh ~/.kube, etc while running the sbx, no matter where it is started from.
From my understanding, depending on where I start the sbx, it mounts that directory.

I checked the policy, and it only has network commands. Is it possible to restrict file system access?

Thanks

[MohammadThabetHassan]

The sandbox only sees what you mount, so ~/.ssh and ~/.kube are only exposed when the workspace is your home directory (or a parent of it). Per the Architecture and Security docs, a direct workspace is mounted read-write at the same absolute path, sbx run uses the current directory when you don't pass a path, and outside the workspace and the shared skills store the agent can't reach the host filesystem. So the risky case is starting sbx run from ~, which mounts your whole home read-write. Starting it from ~/code/myproject, or passing the project directory as the workspace path, keeps those dot directories out of the VM. If you also don't want the agent editing your working tree, clone mode mounts the repo read-only at /run/sandbox/source and the agent works on a private clone.

You're right that sbx policy locally is network only (the docs say sbx policy deny applies to network access). The "no matter where it is started from" control is the filesystem access policy, which allowlists the host paths a sandbox may mount with read / write rules such as ~/code/**, and a mount outside them fails at creation with mount policy denied. That is part of organization governance, though, which is a separate paid subscription: https://docs.docker.com/ai/sandboxes/governance/access-controls/filesystem/

Without that, a small shell guard covers the common mistake of launching from home:

sbx() {
  if [ "$1" = run ]; then
    case "$PWD" in
      "$HOME"|"${HOME%/*}"|/) echo "sbx: not mounting $PWD, cd into a project first" >&2; return 1 ;;
    esac
  fi
  command sbx "$@"
}

It only checks the current directory, so an explicit path you pass is still up to you, but it stops the default mount from ever being ~.

[yadavan88]

Thanks for the answer, so in my case, I think I should use tools such as nono to have control on the file paths.

[rcjsuen]

We are investigating a way to block mounts based on an ignore file (#40 (comment)) which should help with your scenario here.