mellions-sandboxlisted

<!-- Mellions Engineer | LetA Tech Ltd. | leta@letatech.ca --> # mellions-sandbox ## The invariant **Use a disposable, isolated, reproducible execution environment to reproduce defects, test implementations and run adversarial or falsification experiments, without contaminating the host.** That is the requirement, and no isolation technology is. A method that demands one mechanism everywhere refuses to run experiments on a host whose isolation exists under another name, and the refusal then gets reported as a blocker. A sandbox is evidence machinery, not merely a security wrapper. What a disposable experiment can answer is not settled by speculation and not asked of the owner: run it. ## Which one ```bash case "$(uname -s)" in Darwin) SBX=leta-mac-sbx ;; # Colima VM Linux) SBX=leta-linux-sbx ;; # Docker + gVisor esac command -v "$SBX" >/dev/null || SBX="<this skill's directory>/scripts/$SBX" ``` They take the same options, so nothing after this point is platform-specific: ```bash "$SBX" [-i IMAGE] [-m MEM] [-c CPUS] [-n none|bridge] [-r PATH] [-w] [-p PORT] [-C] [-N NAME] [--] [cmd ...] "$SBX" status # what is up "$SBX" down # destroy it, and say what survived ``` Defaults: `ubuntu:24.04`, 2g memory with swap pinned to it, 2 CPUs, 512 pids, `--rm`, network **none**, every capability dropped, `-r` mounted read-only at `/work`, `-p` published on loopback only. `-w` makes the mount writable and runs as your uid so host files keep their ownershi