kern-sandbox 0.2.22 → 0.2.23

package/README.md

@@ -78,14 +78,20 @@ spawns a **fresh** box on that shared workspace, so file state persists but in-m
 (write to disk for continuity). `withSandbox` opens the session and cleans it up, even on throw:
 
 ```js
-await kern.withSandbox({ setup: "pip install pandas" }, async (sbx) => {
-  await sbx.writeFile("data.csv", csvBytes);
-  const r = await sbx.runCode(
-    "import pandas as pd; print(pd.read_csv('data.csv').describe())",
-  );
-  console.log(r.stdout);          // network off, capped, isolated
-  const chart = await sbx.readFile("out.png");
-});
+await kern.withSandbox(
+  { setup: "pip install pandas matplotlib", memoryMb: 1536 },
+  async (sbx) => {
+    await sbx.writeFile("data.csv", "a,b\n1,2\n3,4\n");
+    const r = await sbx.runCode(
+      "import matplotlib; matplotlib.use('Agg')\n" +
+        "import pandas as pd, matplotlib.pyplot as plt\n" +
+        "df = pd.read_csv('data.csv'); print(df.describe())\n" +
+        "df.plot(); plt.savefig('out.png')",
+    );
+    console.log(r.stdout);        // network off, capped, isolated
+    const chart = await sbx.readFile("out.png");   // a Uint8Array of the PNG
+  },
+);
 ```
 
 `setup` is the **only** moment the network is on (a separate box that installs deps into the workspace
@@ -214,6 +220,13 @@ memory, scratch that does not survive a call, and the two writable places a tool
 `network: false` gives the run phase no network and `network: true` gives it the host's. `egressAllow`
 is the middle one, and usually the one an agent wants:
 
+**`network: true` includes the host's LOOPBACK, which is where unauthenticated services live.** It
+puts the box in the host's network namespace, so `127.0.0.1` inside the box is the host's
+`127.0.0.1`: a reviewer's cell connected to `127.0.0.1:22` and read back `SSH-2.0-OpenSSH_9.6p1`,
+and a developer's laptop is where a database, a Redis and a dashboard sit bound to localhost with no
+password. The same connect is refused under the default `network: false`, and `egressAllow` refuses
+it too, because that one goes through kern's proxy rather than through the host's stack.
+
 ```js
 await withSandbox({ egressAllow: ["pypi.org", "files.pythonhosted.org"] }, async (sbx) => { /* ... */ });
 ```

package/index.js

@@ -36,7 +36,7 @@ const crypto = require("crypto");
 const zlib = require("zlib");
 const { spawn, spawnSync } = require("child_process");
 
-const VERSION = "0.2.22";
+const VERSION = "0.2.23";
 
 const DEFAULT_IMAGE = "python:3.12-slim";
 const WORKSPACE = "/workspace"; // where the persistent workspace is mounted inside every box

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kern-sandbox",
-  "version": "0.2.22",
+  "version": "0.2.23",
   "description": "kern is a fast, rootless sandbox and virtual resource runtime for any workload, including untrusted and LLM-generated code; kern-sandbox is its Node/TypeScript binding. Run untrusted or agent-generated code (Python/JS/Bash) in a real, kernel-enforced box in single-digit milliseconds, with no cloud, no account and no VM.",
   "keywords": [
     "sandbox",