Create initial sandbox configuration spec.

This configuration will serve as the base for various language-specific
sandbox APIs.

PiperOrigin-RevId: 877625759

Author: manninglucas

sandboxexec/proto/BUILD

@@ -0,0 +1,11 @@
+load("//tools:defs.bzl", "proto_library")
+
+package(
+    default_applicable_licenses = ["//:license"],
+    licenses = ["notice"],
+)
+
+proto_library(
+    name = "sandbox_options",
+    srcs = ["sandbox_options.proto"],
+)

sandboxexec/proto/defaults.textproto

@@ -0,0 +1,235 @@
+# proto-file: sandbox_options.proto
+# proto-message: SandboxOptions
+
+networking_options {
+  enable_external_networking: false
+}
+
+start_timeout_ms: 5000
+
+env_vars {
+  name: "PATH"
+  policy: ENV_VAR_POLICY_FORWARD
+}
+env_vars {
+  name: "EDITOR"
+  policy: ENV_VAR_POLICY_FORWARD
+}
+env_vars {
+  name: "SHELL"
+  policy: ENV_VAR_POLICY_FORWARD
+}
+env_vars {
+  name: "HOME"
+  policy: ENV_VAR_POLICY_FORWARD
+}
+env_vars {
+  name: "LANG"
+  policy: ENV_VAR_POLICY_FORWARD
+}
+env_vars {
+  name: "LANGUAGE"
+  policy: ENV_VAR_POLICY_FORWARD
+}
+env_vars {
+  name: "LC_ALL"
+  policy: ENV_VAR_POLICY_FORWARD
+}
+env_vars {
+  name: "LC_CTYPE"
+  policy: ENV_VAR_POLICY_FORWARD
+}
+env_vars {
+  name: "LC_MESSAGES"
+  policy: ENV_VAR_POLICY_FORWARD
+}
+env_vars {
+  name: "LC_NUMERIC"
+  policy: ENV_VAR_POLICY_FORWARD
+}
+env_vars {
+  name: "LC_TIME"
+  policy: ENV_VAR_POLICY_FORWARD
+}
+env_vars {
+  name: "PAGER"
+  policy: ENV_VAR_POLICY_FORWARD
+}
+env_vars {
+  name: "PYTHONPATH"
+  policy: ENV_VAR_POLICY_FORWARD
+}
+env_vars {
+  name: "USER"
+  policy: ENV_VAR_POLICY_FORWARD
+}
+env_vars {
+  name: "USERNAME"
+  policy: ENV_VAR_POLICY_FORWARD
+}
+env_vars {
+  name: "TERM"
+  policy: ENV_VAR_POLICY_UNSET
+}
+
+mounts {
+  sandbox_path: "/bin"
+  host_mount {
+    host_path: "/bin"
+  }
+}
+mounts {
+  sandbox_path: "/lib"
+  host_mount {
+    host_path: "/lib"
+  }
+}
+mounts {
+  sandbox_path: "/lib64"
+  host_mount {
+    host_path: "/lib64"
+  }
+}
+mounts {
+  sandbox_path: "/sbin"
+  host_mount {
+    host_path: "/sbin"
+  }
+}
+mounts {
+  sandbox_path: "/usr"
+  host_mount {
+    host_path: "/usr"
+  }
+}
+mounts {
+  sandbox_path: "/etc/shells"
+  host_mount {
+    host_path: "/etc/shells"
+  }
+}
+mounts {
+  sandbox_path: "/etc/profile"
+  host_mount {
+    host_path: "/etc/profile"
+  }
+}
+mounts {
+  sandbox_path: "/etc/profile.d"
+  host_mount {
+    host_path: "/etc/profile.d"
+  }
+}
+mounts {
+  sandbox_path: "/etc/mime.types"
+  host_mount {
+    host_path: "/etc/mime.types"
+  }
+}
+mounts {
+  sandbox_path: "/etc/nsswitch.conf"
+  host_mount {
+    host_path: "/etc/nsswitch.conf"
+  }
+}
+mounts {
+  sandbox_path: "/etc/services"
+  host_mount {
+    host_path: "/etc/services"
+  }
+}
+mounts {
+  sandbox_path: "/etc/bashrc"
+  host_mount {
+    host_path: "/etc/bashrc"
+  }
+}
+mounts {
+  sandbox_path: "/etc/localtime"
+  host_mount {
+    host_path: "/etc/localtime"
+  }
+}
+mounts {
+  sandbox_path: "$HOME"
+  host_mount {
+    host_path: "$HOME"
+  }
+}
+mounts {
+  sandbox_path: "/home"
+  sandbox_tmpfs_mount {}
+}
+mounts {
+  sandbox_path: "$HOME/.cache"
+  sandbox_tmpfs_mount {}
+}
+mounts {
+  sandbox_path: "/dev/shm"
+  sandbox_tmpfs_mount {}
+}
+mounts {
+  sandbox_path: "/boot"
+  sandbox_tmpfs_mount {}
+}
+mounts {
+  sandbox_path: "/lost+found"
+  sandbox_tmpfs_mount {}
+}
+mounts {
+  sandbox_path: "/media"
+  sandbox_tmpfs_mount {}
+}
+mounts {
+  sandbox_path: "/run"
+  sandbox_tmpfs_mount {}
+}
+mounts {
+  sandbox_path: "/root"
+  sandbox_tmpfs_mount {}
+}
+mounts {
+  sandbox_path: "/run/user"
+  sandbox_tmpfs_mount {}
+}
+mounts {
+  sandbox_path: "/run/user/$USER"
+  sandbox_tmpfs_mount {}
+}
+mounts {
+  sandbox_path: "/usr/etc"
+  sandbox_tmpfs_mount {}
+}
+mounts {
+  sandbox_path: "/usr/var"
+  sandbox_tmpfs_mount {}
+}
+mounts {
+  sandbox_path: "/tmp"
+  sandbox_tmpfs_mount {}
+}
+mounts {
+  sandbox_path: "/var/cache"
+  sandbox_tmpfs_mount {}
+}
+mounts {
+  sandbox_path: "/var/lib/dbus"
+  sandbox_tmpfs_mount {}
+}
+mounts {
+  sandbox_path: "/var/log"
+  sandbox_tmpfs_mount {}
+}
+mounts {
+  sandbox_path: "/var/run"
+  sandbox_tmpfs_mount {}
+}
+mounts {
+  sandbox_path: "/var/spool"
+  sandbox_tmpfs_mount {}
+}
+mounts {
+  sandbox_path: "/var/tmp"
+  sandbox_tmpfs_mount {}
+}
+

sandboxexec/proto/sandbox_options.proto

@@ -0,0 +1,91 @@
+// Copyright 2026 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+edition = "2024";
+
+package cloud_gvisor_sandboxexec;
+
+message SandboxOptions {
+  repeated Mount mounts = 1;
+
+  NetworkingOptions networking_options = 2;
+
+  string stdout_file = 3;
+  string stderr_file = 4;
+
+  repeated EnvVar env_vars = 5;
+
+  DebugOptions debug_options = 6;
+
+  int64 start_timeout_ms = 7;
+}
+
+message NetworkingOptions {
+  bool enable_external_networking = 1;
+  repeated PortMapping port_mappings = 2;
+  repeated string domain_allowlist = 3;
+  repeated string domain_denylist = 4;
+}
+
+message DebugOptions {
+  string enable_debug_logs = 1;
+  string debug_log_file = 2;
+}
+
+message EnvVar {
+  string name = 1;
+
+  enum EnvVarPolicy {
+    ENV_VAR_POLICY_UNSPECIFIED = 0;
+    ENV_VAR_POLICY_FORWARD = 1;
+    ENV_VAR_POLICY_UNSET = 2;
+  }
+  oneof policy_or_value {
+    string value = 2;
+    EnvVarPolicy policy = 3;
+  }
+}
+
+message PortMapping {
+  uint32 sandbox_port = 1;
+  uint32 host_port = 2;
+
+  enum PortMappingType {
+    PORT_MAPPING_TYPE_TCP = 0;
+    PORT_MAPPING_TYPE_UDP = 1;
+  }
+  PortMappingType port_mapping_type = 3;
+}
+
+message MountOptions {
+  // By default, host mounts are structured as an overlay. If passthrough is
+  // enabled, the host path is mounted directly into the sandbox and writes
+  // persist to the host.
+  bool passthrough = 1;
+}
+
+message Mount {
+  string target = 1;
+  oneof mount {
+    HostMount host_mount = 2;
+    SandboxTmpfsMount sandbox_tmpfs_mount = 3;
+  }
+}
+
+message HostMount {
+  string host_path = 1;
+  MountOptions options = 2;
+}
+
+message SandboxTmpfsMount {}