oz0-node sandbox
Harness sessions, and the jobs an outside event such as a webhook starts, run in sandbox tier 1 where the machine has it: bubblewrap on Linux, Seatbelt on macOS.
For: Operators and developers looking up a command.
Harness sessions, and the jobs an outside event such as a webhook starts, run in sandbox tier 1 where the machine has it: bubblewrap on Linux, Seatbelt on macOS. A sandboxed process writes only to its job's directories, cannot see the node's data directory or other jobs, and reaches the network only through the node's egress proxy, which allows the hosts its tenant, plugin and agent list.
Machines without it run tier 0, and jobs that need tier 1 go to other nodes.
Usage
oz0-node sandbox [command]
Subcommands
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--data-dir | string | ~/.local/share/orchestrator-zero-node | where the node keeps its identity, uv, Python, runtimes and state |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0-node commands and the global flags.