sbox plan
phase: 2
config: $ROOT/examples/bun-smoke/sbox.yaml

command: bun install --ignore-scripts
argv:
  - bun
  - install
  - --ignore-scripts

audit:
  install_style: true
  strict_security: false
  trusted_image_required: false
  sensitive_pass_through: <none>
  lockfile: required, present (bun.lock or bun.lockb)
  pre_run: bun audit

resolution:
  profile: install
  profile source: dispatch rule `bun-install` via pattern `bun install --ignore-scripts`
  mode: sandbox
  mode source: profile

runtime:
  backend: podman
  image: ref:oven/bun:1.2.16
  image_trust: mutable-reference
  verify_signature: not requested
  user mapping: keep-id

workspace:
  root: $ROOT
  invocation cwd: $ROOT/examples/bun-smoke
  effective host dir: $ROOT/examples/bun-smoke
  mount: /workspace
  sandbox cwd: /workspace/examples/bun-smoke
  cwd mapping: mapped from invocation cwd

policy:
  network: on
  network_allow: <none>
  writable: true
  no_new_privileges: true
  read_only_rootfs: false
  reuse_container: false
  reusable_session: <none>
  cap_drop: <none>
  cap_add: <none>
  ports: <none>
  pull_policy: <default>

environment:
  - BUN_INSTALL_CACHE_DIR=/var/tmp/sbox/bun-cache (set)
  denied: NPM_TOKEN, NODE_AUTH_TOKEN

mounts:
  - bind $ROOT -> /workspace (ro, workspace)
  - bind $ROOT/node_modules -> /workspace/node_modules (rw, workspace)

caches:
  - bun-cache -> /var/tmp/sbox/bun-cache (rw, source: <default>)

secrets:
  <none>
