Issues

• profile: container engine has two spellings — the podman key and @podman-socket/@podman-build; pick one (same question for git, network, dns, nss)

  area:docsarea:policyquestionsev:low
  gomoni/snug#627 · Filter by author vyskocilm opened on Sep 27, 2026
  1

• config: unknown VALUE stays fatal; profile key never narrows a sibling (rule + test); per-file exact-name ignore_unknown (OpenSSH IgnoreUnknown shape); refuse per SELECTION

  area:policyenhancementquestion
  gomoni/snug#624 · Filter by author vyskocilm opened on Sep 27, 2026
  1

• User documentation that cannot drift silently

  area:docssev:low
  gomoni/snug#619 · Filter by author vyskocilm opened on Sep 26, 2026
  1

• Investigate a Zypak-style broker: let a sandboxed app ask snug for a stricter sandbox

  area:supervisorenhancementquestion
  gomoni/snug#584 · Filter by author vyskocilm opened on Sep 17, 2026

• Research: what we can learn from vetto

  gomoni/snug#557 · Filter by author vyskocilm opened on Sep 1, 2026
  1

• Research: what would Landlock add on top of bwrap + seccomp, and what would it cost

  area:policyenhancementquestion
  gomoni/snug#551 · Filter by author vyskocilm opened on Aug 30, 2026
  2

• Idea: snug-in-snug — run a command in a stricter sandbox from inside a sandbox

  area:supervisorenhancementquestion
  gomoni/snug#509 · Filter by author plainsof opened on Aug 28, 2026
  2

• Research: can systemd-nsresourced replace the /etc/subuid + newuidmap requirement for the engine's stage?

  area:supervisorenhancementquestion
  gomoni/snug#482 · Filter by author vyskocilm opened on Aug 28, 2026
  3

• Idea, needs research: a profile cannot bind whichever host path exists AND point a variable at it

  area:policyenhancementquestion
  gomoni/snug#477 · Filter by author vyskocilm opened on Aug 27, 2026

• @http-proxy needs a staged adapter for servers that only bind a port (Java, .NET, containers)

  area:proxyenhancement
  gomoni/snug#476 · Filter by author vyskocilm opened on Aug 27, 2026

• Research: /login inside the sandbox — the callback, the browser, and what must not become a refresh token

  area:identityenhancementquestion
  gomoni/snug#455 · Filter by author vyskocilm opened on Aug 27, 2026
  1

• Idea: bound the sandbox's memory with a cgroup v2 memory.max, because --size bounds each mount and not their sum

  enhancement
  gomoni/snug#283 · Filter by author vyskocilm opened on Aug 21, 2026
  2

• Idea, needs research: a violation channel via SECCOMP_RET_USER_NOTIF — what the payload TRIED to do, wired to a report and never to a decision

  area:policyenhancementquestion
  gomoni/snug#102 · Filter by author vyskocilm opened on Aug 17, 2026

• Tracker: ergonomics and pre-announcement backlog

  sev:low
  gomoni/snug#36 · Filter by author vyskocilm opened on Aug 13, 2026
  6

• Idea: snug setup, a separate binary with its own go.mod, for profile authoring — AFTER the sandbox is finished

  area:identityenhancement
  gomoni/snug#30 · Filter by author vyskocilm opened on Aug 13, 2026