Skip to content
All posts
2 min readtebakopackagingtutorial

Advanced payloads: Jails and profiles: decide what it may touch (2 of 5)

The advanced payloads series: jails and profiles: decide what it may touch.

The Tebako team

github.com/tamatebako
Note

Post 2 of 5 in the series Advanced payloads.

○ ● ○ ○ ○

  1. Advanced payloads: Trace: see what your payload touches

  2. Advanced payloads: Jails and profiles: decide what it may touch (this post)

  3. Advanced payloads: The image toolbox

  4. Advanced payloads: Runtimes and native code

  5. Advanced payloads: packed-mn: one download, any document
Note

Reference guide: Set a jail policy.

The observe half of the boundary was the last post. This post is the constrain half: profiles and jails — how the policy you drafted becomes the policy that runs, and what is enforced where.

Jails and profiles one payload, three profiles profile: strict deny, nothing granted profile: standard deny + declared needs profile: open legacy escape hatch one jail grammar the run binds TEBAKO_JAIL=deny · --jail deny:arg · jail.yaml env, flag, or baked manifest — precedence is fixed record mode drafts the grants: TEBAKO_JAIL=record tebako run ./myapp -- build tfs needs --from-journal ~/.tebako/journal.log

Figure 1 — Profiles select a policy, the run binds it from env, flag, or manifest, and record mode drafts the grants from a real run.

The grammar

A jail policy has one setting and a list of grants:

jail:
  default: deny        # or open
  mounts:
    - path: $HOME/.fontist
      access: rw
      when: [macos]
      why: "fontist caches and resolves fonts here"

Everything not granted is invisible to the process. The why is mandatory: a declaration that cannot explain itself does not parse.

Binding, three ways

The same policy binds from an environment variable, a command flag, or the manifest itself — TEBAKO_JAIL=deny, --jail deny:arg, or a baked jail.yaml — with a fixed precedence. Per-invocation flags win, so an operator can tighten any payload for one run without touching it:

$ tebako run ./myapp --jail deny -- --help
$ tebako run ./myapp --mount "$HOME/sources:/work:ro" -- build /work

Draft, don’t guess

Record mode — the bridge from the previous post — turns a real run into the draft policy:

$ TEBAKO_JAIL=record tebako run ./myapp -- build
$ tfs needs --from-journal ~/.tebako/journal.log

One declaration, every platform

The declaration is identical everywhere. On Linux and macOS the choke point sits in the filesystem layer; on Windows, enforcement moves to the spawn tier — executables materialize into a cache and start under the same policy computed from the same declarations.

What you can do now

You can take any payload and decide, precisely and reviewably, what it may touch — on every platform tebako ships. The next post opens the images themselves.

Note

Continue with part 3 of 5: The image toolbox.