Whether this environment can ACTUALLY confine untrusted code under bubblewrap.
Linux only. Critically, bwrap --version succeeding is NOT enough: many CI
runners and hardened hosts ship bubblewrap but disable the unprivileged user
namespaces it depends on, so a real confined exec fails even though the binary
is present. We probe that real capability — a throwaway bwrap --unshare-all … true — and cache it, so we never claim confinement we can't deliver.
decideSandbox then correctly refuses untrusted code in such an environment
(rather than running it in a "sandbox" that doesn't actually sandbox), and the
sandbox-gated tests skip instead of failing. The result is cached because the
probe spawns a process and the answer can't change within a run.
Whether this environment can ACTUALLY confine untrusted code under bubblewrap. Linux only. Critically,
bwrap --versionsucceeding is NOT enough: many CI runners and hardened hosts ship bubblewrap but disable the unprivileged user namespaces it depends on, so a real confined exec fails even though the binary is present. We probe that real capability — a throwawaybwrap --unshare-all … true— and cache it, so we never claim confinement we can't deliver.decideSandboxthen correctly refuses untrusted code in such an environment (rather than running it in a "sandbox" that doesn't actually sandbox), and the sandbox-gated tests skip instead of failing. The result is cached because the probe spawns a process and the answer can't change within a run.