sbox plan
phase: 2
config: $ROOT/examples/poetry-smoke/sbox.yaml

command: poetry install
argv:
  - poetry
  - install

audit:
  install_style: true
  strict_security: false
  trusted_image_required: false
  sensitive_pass_through: <none>
  lockfile: required, present (poetry.lock)
  pre_run: <none>

resolution:
  profile: install
  profile source: dispatch rule `poetry-install` via pattern `poetry install`
  mode: sandbox
  mode source: profile

runtime:
  backend: podman
  image: ref:python:3.13-slim
  image_trust: mutable-reference
  verify_signature: not requested
  user mapping: keep-id

workspace:
  root: $ROOT
  invocation cwd: $ROOT/examples/poetry-smoke
  effective host dir: $ROOT/examples/poetry-smoke
  mount: /workspace
  sandbox cwd: /workspace/examples/poetry-smoke
  cwd mapping: mapped from invocation cwd

policy:
  network: on
  network_allow: <none>
  writable: true
  no_new_privileges: true
  read_only_rootfs: false
  reuse_container: false
  reusable_session: <none>
  cap_drop: <none>
  cap_add: <none>
  ports: <none>
  pull_policy: <default>

environment:
  - POETRY_CACHE_DIR=/var/tmp/sbox/poetry-cache (set)
  - POETRY_VIRTUALENVS_PATH=/var/tmp/sbox/poetry-venvs (set)
  denied: PYPI_TOKEN

mounts:
  - bind $ROOT -> /workspace (ro, workspace)

caches:
  - poetry-cache -> /var/tmp/sbox/poetry-cache (rw, source: <default>)
  - poetry-venvs -> /var/tmp/sbox/poetry-venvs (rw, source: <default>)

secrets:
  <none>
