From 895dc3529645fbad8763247042138b87f75d50de Mon Sep 17 00:00:00 2001 From: Cong Wang Date: Thu, 13 Aug 2026 17:02:14 -0700 Subject: [PATCH] cli: drop the inert -i/--interactive flag The flag was parsed and never read: `sandlock run` has a single run path that calls `run_interactive`, which inherits the caller's fds 0/1/2, so a sandboxed shell is on the terminal with or without it. Capture mode exists for library callers, who cannot redirect their own fds without clobbering their own stdout; a CLI caller has already chosen its stdio before exec, so there is no second mode for the flag to select. It also listed itself in --help with an empty description, reading as a behaviour switch that does not exist. Fixes #177 Signed-off-by: Cong Wang --- README.md | 4 ++-- crates/sandlock-cli/src/main.rs | 3 --- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 99a224a3..8d329ffc 100644 --- a/README.md +++ b/README.md @@ -105,8 +105,8 @@ cargo install --path crates/sandlock-cli # Basic confinement sandlock run -r /usr -r /lib -w /tmp -- ls /tmp -# Interactive shell -sandlock run -i -r /usr -r /lib -r /lib64 -r /bin -r /etc -w /tmp -- /bin/sh +# Interactive shell (the sandboxed command inherits the terminal) +sandlock run -r /usr -r /lib -r /lib64 -r /bin -r /etc -w /tmp -- /bin/sh # Resource limits + timeout sandlock run -m 512M -P 20 -t 30 -- ./compute.sh diff --git a/crates/sandlock-cli/src/main.rs b/crates/sandlock-cli/src/main.rs index f5fc5a30..5ff2e833 100644 --- a/crates/sandlock-cli/src/main.rs +++ b/crates/sandlock-cli/src/main.rs @@ -140,9 +140,6 @@ struct RunArgs { #[arg(short = 'e', long = "exec-shell", value_name = "CMD")] exec_shell: Option, - #[arg(short = 'i', long)] - interactive: bool, - /// Use a local Docker image as chroot rootfs, given by reference /// (e.g. `python:3.12-slim`, a digest, or an image id). The image /// must already be present in local Docker storage; sandlock never