geomys/gVisor Sandboxed Step

Run commands in a gVisor sandbox

Trust Signals

workflow.ymlSHA-pinned

uses: geomys/sandboxed-step@7d75eb49d17fdeeb3656b3a57d35932d205bcfb9 # v1.2.1

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
run	Commands to run in the sandbox	yes	—
allow-checkout-credentials	Allow running even if checkout action has persisted credentials (NOT RECOMMENDED)	no	false
persist-workspace-changes	Allow changes to the workspace to persist on the host	no	false
env	Additional environment variables to set in the sandbox (one per line, KEY=VALUE format)	no	""
disable-network	Disable network access in the sandbox (default: false)	no	false
rootfs-image	Docker image to use as the rootfs (default: ghcr.io/catthehacker/ubuntu:runner-24.04)	no	ghcr.io/catthehacker/ubuntu:runner-24.04

no outputs