CI sandboxing
A CI job runs npm install, pip install, or cargo build over transitive dependencies you have not audited. Any one of them can run arbitrary install scripts. ZViz shrinks the reachable syscall surface and drops every capability, so a malicious postinstall has far less to work with.
The problem
A CI pipeline runs npm install on 47 transitive dependencies you have never read, or pip install on a
package that runs a setup.py you did not write. Install scripts execute with the job’s privileges. Under
plain runc, that means ~14 capabilities, a large reachable syscall surface, and open network egress — a
comfortable environment for a malicious postinstall.
How ZViz helps
ZViz tightens every default for the untrusted-build case:
- All 41 capabilities dropped — the build runs with none.
- A selective-denial seccomp filter —
ptrace,mount,init_module, and the rest of the dangerous set are refused. - A Landlock ruleset limiting which paths the build can touch.
- A default-deny network posture — you allow exactly the registries the build needs, and a compromised dependency cannot exfiltrate quietly.
Compared to plain runc, the reachable surface is dramatically smaller.
When to reach for something else
Builds that create their own namespaces — Bazel and Nix sandboxes, Docker-in-Docker — need gVisor, which emulates the required syscalls. For ordinary dependency-installing builds, ZViz gives you a tighter box at native speed.
Frequently Asked Questions
My build needs network access for package downloads. Does ZViz block that?
ZViz defaults network egress to deny, but you allow what the build legitimately needs. The point is that egress is explicit rather than open by default, so a compromised dependency cannot phone home silently.
Will ZViz run my existing build image?
Yes, if the build does not require mount, unshare, or nested containers. ZViz is OCI-compatible and runs a rootfs from docker export. Builds that need internal sandboxing (Bazel, Nix) should use gVisor.
Related
AI agent code execution
Run LLM-generated code inside ZViz so a prompt injection fails at the kernel boundary, not in production.
Use caseCode-execution platforms
Back notebooks, REPLs, and "run this snippet" products with a runtime that assumes every submission is hostile.
Use casePer-request ephemeral isolation
Spin up a fresh sandbox per request and tear it down, with no daemon in the way.