{
  "id": "sandbox:read-only-air-gapped",
  "_kind": "Sandbox",
  "_file": "lifecycle/sandboxes/example-sandbox-default-container.yaml",
  "_cluster": "lifecycle",
  "attributes": {
    "displayName": "Read-only air-gapped sandbox",
    "filesystemPolicy": "read-only",
    "networkPolicy": "none",
    "description": "Maximally restrictive sandbox for review-only / dry-run workloads:\nworkspace mounted read-only, no network, env scrubbed, no secrets.\n",
    "fsAllowList": [
      "/workspace/**"
    ],
    "fsDenyList": [],
    "netAllowList": [],
    "netDenyList": [
      "*"
    ],
    "execAllowedBinaries": [
      "cat",
      "ls",
      "grep",
      "rg",
      "jq"
    ],
    "execDeniedBinaries": [
      "sh",
      "bash",
      "zsh"
    ],
    "envVarScope": "scrub-all-set-by-config",
    "secretAccessScope": "none",
    "auditLogPolicy": "otel-traced",
    "policyEvaluationPoint": "continuous"
  },
  "outgoingEdges": [
    {
      "from": "sandbox:read-only-air-gapped",
      "to": "layer:9-sandbox",
      "kind": "realizes",
      "attributes": {}
    }
  ],
  "incomingEdges": []
}