Reuse the same layered config approach as anvilsrv: - global.yaml provides base permissions (including /usr, /lib, /bin) - sandbox/<name>.yaml adds sandbox-specific permissions - Merge uses most-permissive-wins strategy This fixes the fallback to default sandbox, which now has proper system paths from global.yaml. |
||
|---|---|---|
| .. | ||
| config.go | ||
| detect.go | ||
| wrapper.go | ||