Sandboxed wrappers for Cargo and rust-analyzer on Linux

announcements
1

Hello,

As is widely known, cargo and rust-analyzer should be only used with dependencies (and dependencies-of-dependencies) that one trusts: Security - rust-analyzer

I would like to share a sandboxing solution for cargo and rust-analyzer on Linux that I developed over the last weeks. My goal was to find a good balance between security and usability.

This project has grown into a general-purpose sandboxing solution for the Linux command line:

The Rust wrappers have separate documentation.

Feedback is appreciated!

2

I continued developing and using these wrappers. With the latest release (0.3.0) they are now drop-in replacements for real Cargo and rust-analyzer for most practical workflows. The additional value that the wrappers provide is maintaining two useful and complementary security policies:

  • Minimize filesystem exposure. The wrappers grant each command access only to the workspace and tool state it needs.

  • Separate network access from code execution. Cargo subcommands whose purpose is dependency resolution or retrieval may get network access. Common build-like subcommands (like build or run) are split into a networked prefetch phase followed by the requested command in an offline sandbox. The wrapped rust-analyzer follows the same principle: it prefetches dependencies first, then launches real rust-analyzer offline.

I also worked hard on improving the documentation:

I hope that some people here will find these wrappers useful.