Nsjail Skill
Linux sandboxing and process isolation using nsjail.
Commands
| Command | Description |
|---|---|
nsjail_config |
Generate nsjail configuration |
nsjail_profile |
Generate nsjail profile |
nsjail_run |
Run command in nsjail |
nsjail_config
Generate an nsjail configuration.
nsjail_profile
Generate an nsjail profile.
nsjail_run
Run a command in nsjail.
Usage Examples
# Generate minimal nsjail config
@omni("nsjail.nsjail_config", {"skill_id": "data-processor", "mode": "local"})
# Generate standard profile
@omni("nsjail.nsjail_profile", {"profile_type": "standard", "skill_id": "web-scraper"})
# Run command in nsjail
@omni("nsjail.nsjail_run", {"cmd": ["python3", "script.py"], "mode": "local"})
Concepts
| Topic | Description | Reference |
|---|---|---|
| Profile Types | Sandbox profiles | profiles.md |
| Resource Limits | CPU/memory limits | rlimits.md |
| Network Policies | Network isolation | network.md |
Best Practices
- Start with minimal profile, escalate as needed
- Use network deny unless required
- Set appropriate timeouts
- Use cgroups for resource control
Related Skills
| Topic | Description | Reference |
|---|---|---|
| Seatbelt | macOS sandboxing | seatbelt |
| NCL Modules | Nickel module patterns | nickel-modules.md |