[{"data":1,"prerenderedAt":809},["ShallowReactive",2],{"doc-\u002Fdocs\u002Fsecurity\u002Fsandboxing-and-hardening":3},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"body":10,"_type":803,"_id":804,"_source":805,"_file":806,"_stem":807,"_extension":808},"\u002Fsecurity\u002Fsandboxing-and-hardening","security",false,"","Dedicated Sandboxes & Hardening","Per-instance network isolation, kernel air-gapping, WebSocket CSWSH protection, and container security controls.",{"type":11,"children":12,"toc":791},"root",[13,21,34,38,45,57,66,73,154,157,163,169,182,327,332,338,358,549,561,582,585,591,603,743,785],{"type":14,"tag":15,"props":16,"children":18},"element","h1",{"id":17},"dedicated-sandboxes-hardening",[19],{"type":20,"value":8},"text",{"type":14,"tag":22,"props":23,"children":24},"p",{},[25,32],{"type":14,"tag":26,"props":27,"children":29},"code",{"className":28},[],[30],{"type":20,"value":31},"webtop-manage",{"type":20,"value":33}," implements defense-in-depth security controls across container networking, API endpoints, and host filesystem mounts.",{"type":14,"tag":35,"props":36,"children":37},"hr",{},[],{"type":14,"tag":39,"props":40,"children":42},"h2",{"id":41},"dedicated-sandbox-networks-air-gap-control",[43],{"type":20,"value":44},"🌐 Dedicated Sandbox Networks & Air-Gap Control",{"type":14,"tag":22,"props":46,"children":47},{},[48,50,55],{"type":20,"value":49},"By default, containers attached to Docker's default bridge network can freely discover and ping each other. ",{"type":14,"tag":26,"props":51,"children":53},{"className":52},[],[54],{"type":20,"value":31},{"type":20,"value":56}," isolates every workstation into a dedicated user-defined bridge network:",{"type":14,"tag":58,"props":59,"children":61},"pre",{"code":60},"┌────────────────────────────────────────────────────────────────────────┐\n│ Docker Daemon                                                          │\n│                                                                        │\n│  [ Default State: Complete Isolation ]                                 │\n│   ┌────────────────────────┐         ✕ (No Route \u002F Discovered)         │\n│   │ Workstation Box A      │ ────────────────────────► [ Production DB ]│\n│   │ (workstation-a-net)    │                                           │\n│   └────────────────────────┘                                           │\n│                                                                        │\n│  [ Explicit Network Attachment via webtop-manage ]                     │\n│   ┌────────────────────────┐         ✓ (DNS: http:\u002F\u002Fgitea:3000)        │\n│   │ Workstation Box B      │ ────────────────────────► [ Gitea Dev ]   │\n│   │ (Attached: `dev-net`)  │                                           │\n│   └────────────────────────┘                                           │\n└────────────────────────────────────────────────────────────────────────┘\n",[62],{"type":14,"tag":26,"props":63,"children":64},{"__ignoreMap":7},[65],{"type":20,"value":60},{"type":14,"tag":67,"props":68,"children":70},"h3",{"id":69},"egress-policies",[71],{"type":20,"value":72},"Egress Policies",{"type":14,"tag":74,"props":75,"children":76},"table",{},[77,102],{"type":14,"tag":78,"props":79,"children":80},"thead",{},[81],{"type":14,"tag":82,"props":83,"children":84},"tr",{},[85,92,97],{"type":14,"tag":86,"props":87,"children":89},"th",{"align":88},"left",[90],{"type":20,"value":91},"Egress Policy",{"type":14,"tag":86,"props":93,"children":94},{"align":88},[95],{"type":20,"value":96},"Driver Setting",{"type":14,"tag":86,"props":98,"children":99},{"align":88},[100],{"type":20,"value":101},"Security Behavior",{"type":14,"tag":103,"props":104,"children":105},"tbody",{},[106,129],{"type":14,"tag":82,"props":107,"children":108},{},[109,119,124],{"type":14,"tag":110,"props":111,"children":112},"td",{"align":88},[113],{"type":14,"tag":114,"props":115,"children":116},"strong",{},[117],{"type":20,"value":118},"Full (Default)",{"type":14,"tag":110,"props":120,"children":121},{"align":88},[122],{"type":20,"value":123},"Standard Bridge",{"type":14,"tag":110,"props":125,"children":126},{"align":88},[127],{"type":20,"value":128},"Full outbound HTTP\u002FHTTPS access for package managers and development tools.",{"type":14,"tag":82,"props":130,"children":131},{},[132,140,149],{"type":14,"tag":110,"props":133,"children":134},{"align":88},[135],{"type":14,"tag":114,"props":136,"children":137},{},[138],{"type":20,"value":139},"Restricted \u002F Air-Gap",{"type":14,"tag":110,"props":141,"children":142},{"align":88},[143],{"type":14,"tag":26,"props":144,"children":146},{"className":145},[],[147],{"type":20,"value":148},"--internal=true",{"type":14,"tag":110,"props":150,"children":151},{"align":88},[152],{"type":20,"value":153},"Completely disables default gateway routes. The workstation cannot reach the WAN\u002FInternet under any circumstance.",{"type":14,"tag":35,"props":155,"children":156},{},[],{"type":14,"tag":39,"props":158,"children":160},{"id":159},"️-web-api-hardening",[161],{"type":20,"value":162},"🛡️ Web & API Hardening",{"type":14,"tag":67,"props":164,"children":166},{"id":165},"_1-cross-site-websocket-hijacking-cswsh-defense",[167],{"type":20,"value":168},"1. Cross-Site WebSocket Hijacking (CSWSH) Defense",{"type":14,"tag":22,"props":170,"children":171},{},[172,174,180],{"type":20,"value":173},"The web terminal WebSocket endpoint (",{"type":14,"tag":26,"props":175,"children":177},{"className":176},[],[178],{"type":20,"value":179},"\u002Fapi\u002Finstances\u002F{id}\u002Fterminal",{"type":20,"value":181},") validates origin headers:",{"type":14,"tag":58,"props":183,"children":187},{"code":184,"language":185,"meta":7,"className":186,"style":7},"opts := &websocket.AcceptOptions{\n    OriginPatterns: []string{\n        \"localhost:*\",\n        \"127.0.0.1:*\",\n        \"[::1]:*\",\n        r.Host, \u002F\u002F Dynamically allows active reverse proxy domain\n    },\n}\n","go","language-go shiki shiki-themes github-dark github-dark github-light",[188],{"type":14,"tag":26,"props":189,"children":190},{"__ignoreMap":7},[191,235,253,268,281,294,309,318],{"type":14,"tag":192,"props":193,"children":196},"span",{"class":194,"line":195},"line",1,[197,203,209,214,220,225,230],{"type":14,"tag":192,"props":198,"children":200},{"style":199},"--shiki-default:#E1E4E8;--shiki-dark:#E1E4E8;--shiki-light:#24292E",[201],{"type":20,"value":202},"opts ",{"type":14,"tag":192,"props":204,"children":206},{"style":205},"--shiki-default:#F97583;--shiki-dark:#F97583;--shiki-light:#D73A49",[207],{"type":20,"value":208},":=",{"type":14,"tag":192,"props":210,"children":211},{"style":205},[212],{"type":20,"value":213}," &",{"type":14,"tag":192,"props":215,"children":217},{"style":216},"--shiki-default:#B392F0;--shiki-dark:#B392F0;--shiki-light:#6F42C1",[218],{"type":20,"value":219},"websocket",{"type":14,"tag":192,"props":221,"children":222},{"style":199},[223],{"type":20,"value":224},".",{"type":14,"tag":192,"props":226,"children":227},{"style":216},[228],{"type":20,"value":229},"AcceptOptions",{"type":14,"tag":192,"props":231,"children":232},{"style":199},[233],{"type":20,"value":234},"{\n",{"type":14,"tag":192,"props":236,"children":238},{"class":194,"line":237},2,[239,244,249],{"type":14,"tag":192,"props":240,"children":241},{"style":199},[242],{"type":20,"value":243},"    OriginPatterns: []",{"type":14,"tag":192,"props":245,"children":246},{"style":205},[247],{"type":20,"value":248},"string",{"type":14,"tag":192,"props":250,"children":251},{"style":199},[252],{"type":20,"value":234},{"type":14,"tag":192,"props":254,"children":256},{"class":194,"line":255},3,[257,263],{"type":14,"tag":192,"props":258,"children":260},{"style":259},"--shiki-default:#9ECBFF;--shiki-dark:#9ECBFF;--shiki-light:#032F62",[261],{"type":20,"value":262},"        \"localhost:*\"",{"type":14,"tag":192,"props":264,"children":265},{"style":199},[266],{"type":20,"value":267},",\n",{"type":14,"tag":192,"props":269,"children":271},{"class":194,"line":270},4,[272,277],{"type":14,"tag":192,"props":273,"children":274},{"style":259},[275],{"type":20,"value":276},"        \"127.0.0.1:*\"",{"type":14,"tag":192,"props":278,"children":279},{"style":199},[280],{"type":20,"value":267},{"type":14,"tag":192,"props":282,"children":284},{"class":194,"line":283},5,[285,290],{"type":14,"tag":192,"props":286,"children":287},{"style":259},[288],{"type":20,"value":289},"        \"[::1]:*\"",{"type":14,"tag":192,"props":291,"children":292},{"style":199},[293],{"type":20,"value":267},{"type":14,"tag":192,"props":295,"children":297},{"class":194,"line":296},6,[298,303],{"type":14,"tag":192,"props":299,"children":300},{"style":199},[301],{"type":20,"value":302},"        r.Host, ",{"type":14,"tag":192,"props":304,"children":306},{"style":305},"--shiki-default:#6A737D;--shiki-dark:#6A737D;--shiki-light:#6A737D",[307],{"type":20,"value":308},"\u002F\u002F Dynamically allows active reverse proxy domain\n",{"type":14,"tag":192,"props":310,"children":312},{"class":194,"line":311},7,[313],{"type":14,"tag":192,"props":314,"children":315},{"style":199},[316],{"type":20,"value":317},"    },\n",{"type":14,"tag":192,"props":319,"children":321},{"class":194,"line":320},8,[322],{"type":14,"tag":192,"props":323,"children":324},{"style":199},[325],{"type":20,"value":326},"}\n",{"type":14,"tag":22,"props":328,"children":329},{},[330],{"type":20,"value":331},"Malicious websites open in background tabs cannot establish unauthorized terminal exec sessions.",{"type":14,"tag":67,"props":333,"children":335},{"id":334},"_2-request-body-bounds-dos-mitigation",[336],{"type":20,"value":337},"2. Request Body Bounds (DoS Mitigation)",{"type":14,"tag":22,"props":339,"children":340},{},[341,343,348,350,356],{"type":20,"value":342},"All incoming JSON payloads are capped to ",{"type":14,"tag":114,"props":344,"children":345},{},[346],{"type":20,"value":347},"1 MB",{"type":20,"value":349}," using ",{"type":14,"tag":26,"props":351,"children":353},{"className":352},[],[354],{"type":20,"value":355},"http.MaxBytesReader",{"type":20,"value":357},":",{"type":14,"tag":58,"props":359,"children":361},{"code":360,"language":185,"meta":7,"className":186,"style":7},"func decodeJSON(w http.ResponseWriter, r *http.Request, dst interface{}) error {\n    r.Body = http.MaxBytesReader(w, r.Body, 1024 * 1024)\n    return json.NewDecoder(r.Body).Decode(dst)\n}\n",[362],{"type":14,"tag":26,"props":363,"children":364},{"__ignoreMap":7},[365,461,509,542],{"type":14,"tag":192,"props":366,"children":367},{"class":194,"line":195},[368,373,378,383,389,394,398,403,408,413,418,423,427,432,436,441,446,451,456],{"type":14,"tag":192,"props":369,"children":370},{"style":205},[371],{"type":20,"value":372},"func",{"type":14,"tag":192,"props":374,"children":375},{"style":216},[376],{"type":20,"value":377}," decodeJSON",{"type":14,"tag":192,"props":379,"children":380},{"style":199},[381],{"type":20,"value":382},"(",{"type":14,"tag":192,"props":384,"children":386},{"style":385},"--shiki-default:#FFAB70;--shiki-dark:#FFAB70;--shiki-light:#E36209",[387],{"type":20,"value":388},"w",{"type":14,"tag":192,"props":390,"children":391},{"style":216},[392],{"type":20,"value":393}," http",{"type":14,"tag":192,"props":395,"children":396},{"style":199},[397],{"type":20,"value":224},{"type":14,"tag":192,"props":399,"children":400},{"style":216},[401],{"type":20,"value":402},"ResponseWriter",{"type":14,"tag":192,"props":404,"children":405},{"style":199},[406],{"type":20,"value":407},", ",{"type":14,"tag":192,"props":409,"children":410},{"style":385},[411],{"type":20,"value":412},"r",{"type":14,"tag":192,"props":414,"children":415},{"style":205},[416],{"type":20,"value":417}," *",{"type":14,"tag":192,"props":419,"children":420},{"style":216},[421],{"type":20,"value":422},"http",{"type":14,"tag":192,"props":424,"children":425},{"style":199},[426],{"type":20,"value":224},{"type":14,"tag":192,"props":428,"children":429},{"style":216},[430],{"type":20,"value":431},"Request",{"type":14,"tag":192,"props":433,"children":434},{"style":199},[435],{"type":20,"value":407},{"type":14,"tag":192,"props":437,"children":438},{"style":385},[439],{"type":20,"value":440},"dst",{"type":14,"tag":192,"props":442,"children":443},{"style":205},[444],{"type":20,"value":445}," interface",{"type":14,"tag":192,"props":447,"children":448},{"style":199},[449],{"type":20,"value":450},"{}) ",{"type":14,"tag":192,"props":452,"children":453},{"style":205},[454],{"type":20,"value":455},"error",{"type":14,"tag":192,"props":457,"children":458},{"style":199},[459],{"type":20,"value":460}," {\n",{"type":14,"tag":192,"props":462,"children":463},{"class":194,"line":237},[464,469,474,479,484,489,495,499,504],{"type":14,"tag":192,"props":465,"children":466},{"style":199},[467],{"type":20,"value":468},"    r.Body ",{"type":14,"tag":192,"props":470,"children":471},{"style":205},[472],{"type":20,"value":473},"=",{"type":14,"tag":192,"props":475,"children":476},{"style":199},[477],{"type":20,"value":478}," http.",{"type":14,"tag":192,"props":480,"children":481},{"style":216},[482],{"type":20,"value":483},"MaxBytesReader",{"type":14,"tag":192,"props":485,"children":486},{"style":199},[487],{"type":20,"value":488},"(w, r.Body, ",{"type":14,"tag":192,"props":490,"children":492},{"style":491},"--shiki-default:#79B8FF;--shiki-dark:#79B8FF;--shiki-light:#005CC5",[493],{"type":20,"value":494},"1024",{"type":14,"tag":192,"props":496,"children":497},{"style":205},[498],{"type":20,"value":417},{"type":14,"tag":192,"props":500,"children":501},{"style":491},[502],{"type":20,"value":503}," 1024",{"type":14,"tag":192,"props":505,"children":506},{"style":199},[507],{"type":20,"value":508},")\n",{"type":14,"tag":192,"props":510,"children":511},{"class":194,"line":255},[512,517,522,527,532,537],{"type":14,"tag":192,"props":513,"children":514},{"style":205},[515],{"type":20,"value":516},"    return",{"type":14,"tag":192,"props":518,"children":519},{"style":199},[520],{"type":20,"value":521}," json.",{"type":14,"tag":192,"props":523,"children":524},{"style":216},[525],{"type":20,"value":526},"NewDecoder",{"type":14,"tag":192,"props":528,"children":529},{"style":199},[530],{"type":20,"value":531},"(r.Body).",{"type":14,"tag":192,"props":533,"children":534},{"style":216},[535],{"type":20,"value":536},"Decode",{"type":14,"tag":192,"props":538,"children":539},{"style":199},[540],{"type":20,"value":541},"(dst)\n",{"type":14,"tag":192,"props":543,"children":544},{"class":194,"line":270},[545],{"type":14,"tag":192,"props":546,"children":547},{"style":199},[548],{"type":20,"value":326},{"type":14,"tag":67,"props":550,"children":552},{"id":551},"_3-least-privilege-no-new-privileges",[553,555],{"type":20,"value":554},"3. Least Privilege & ",{"type":14,"tag":26,"props":556,"children":558},{"className":557},[],[559],{"type":20,"value":560},"no-new-privileges",{"type":14,"tag":22,"props":562,"children":563},{},[564,566,572,574,580],{"type":20,"value":565},"All instantiated containers are launched with ",{"type":14,"tag":26,"props":567,"children":569},{"className":568},[],[570],{"type":20,"value":571},"SecurityOpt: []string{\"no-new-privileges:true\"}",{"type":20,"value":573}," and run non-root users (",{"type":14,"tag":26,"props":575,"children":577},{"className":576},[],[578],{"type":20,"value":579},"abc",{"type":20,"value":581},", UID\u002FGID 1000) to prevent privilege escalation exploits.",{"type":14,"tag":35,"props":583,"children":584},{},[],{"type":14,"tag":39,"props":586,"children":588},{"id":587},"host-filesystem-traversal-containment",[589],{"type":20,"value":590},"🚫 Host Filesystem Traversal Containment",{"type":14,"tag":22,"props":592,"children":593},{},[594,596,601],{"type":20,"value":595},"When using the host filesystem browser or attaching bind mounts, ",{"type":14,"tag":26,"props":597,"children":599},{"className":598},[],[600],{"type":20,"value":31},{"type":20,"value":602}," enforces strict path restrictions:",{"type":14,"tag":58,"props":604,"children":606},{"code":605,"language":185,"meta":7,"className":186,"style":7},"var forbiddenPrefixes = []string{\n    \"\u002Fetc\", \"\u002Fproc\", \"\u002Fsys\", \"\u002Fdev\", \"\u002Fvar\u002Frun\", \"\u002Frun\", \"\u002Fboot\",\n    \"\u002Froot\u002F.ssh\", \"c:\u002Fwindows\u002Fsystem32\", \"c:\u002Fwindows\u002Fsyswow64\",\n}\n",[607],{"type":14,"tag":26,"props":608,"children":609},{"__ignoreMap":7},[610,640,706,736],{"type":14,"tag":192,"props":611,"children":612},{"class":194,"line":195},[613,618,623,627,632,636],{"type":14,"tag":192,"props":614,"children":615},{"style":205},[616],{"type":20,"value":617},"var",{"type":14,"tag":192,"props":619,"children":620},{"style":199},[621],{"type":20,"value":622}," forbiddenPrefixes ",{"type":14,"tag":192,"props":624,"children":625},{"style":205},[626],{"type":20,"value":473},{"type":14,"tag":192,"props":628,"children":629},{"style":199},[630],{"type":20,"value":631}," []",{"type":14,"tag":192,"props":633,"children":634},{"style":205},[635],{"type":20,"value":248},{"type":14,"tag":192,"props":637,"children":638},{"style":199},[639],{"type":20,"value":234},{"type":14,"tag":192,"props":641,"children":642},{"class":194,"line":237},[643,648,652,657,661,666,670,675,679,684,688,693,697,702],{"type":14,"tag":192,"props":644,"children":645},{"style":259},[646],{"type":20,"value":647},"    \"\u002Fetc\"",{"type":14,"tag":192,"props":649,"children":650},{"style":199},[651],{"type":20,"value":407},{"type":14,"tag":192,"props":653,"children":654},{"style":259},[655],{"type":20,"value":656},"\"\u002Fproc\"",{"type":14,"tag":192,"props":658,"children":659},{"style":199},[660],{"type":20,"value":407},{"type":14,"tag":192,"props":662,"children":663},{"style":259},[664],{"type":20,"value":665},"\"\u002Fsys\"",{"type":14,"tag":192,"props":667,"children":668},{"style":199},[669],{"type":20,"value":407},{"type":14,"tag":192,"props":671,"children":672},{"style":259},[673],{"type":20,"value":674},"\"\u002Fdev\"",{"type":14,"tag":192,"props":676,"children":677},{"style":199},[678],{"type":20,"value":407},{"type":14,"tag":192,"props":680,"children":681},{"style":259},[682],{"type":20,"value":683},"\"\u002Fvar\u002Frun\"",{"type":14,"tag":192,"props":685,"children":686},{"style":199},[687],{"type":20,"value":407},{"type":14,"tag":192,"props":689,"children":690},{"style":259},[691],{"type":20,"value":692},"\"\u002Frun\"",{"type":14,"tag":192,"props":694,"children":695},{"style":199},[696],{"type":20,"value":407},{"type":14,"tag":192,"props":698,"children":699},{"style":259},[700],{"type":20,"value":701},"\"\u002Fboot\"",{"type":14,"tag":192,"props":703,"children":704},{"style":199},[705],{"type":20,"value":267},{"type":14,"tag":192,"props":707,"children":708},{"class":194,"line":255},[709,714,718,723,727,732],{"type":14,"tag":192,"props":710,"children":711},{"style":259},[712],{"type":20,"value":713},"    \"\u002Froot\u002F.ssh\"",{"type":14,"tag":192,"props":715,"children":716},{"style":199},[717],{"type":20,"value":407},{"type":14,"tag":192,"props":719,"children":720},{"style":259},[721],{"type":20,"value":722},"\"c:\u002Fwindows\u002Fsystem32\"",{"type":14,"tag":192,"props":724,"children":725},{"style":199},[726],{"type":20,"value":407},{"type":14,"tag":192,"props":728,"children":729},{"style":259},[730],{"type":20,"value":731},"\"c:\u002Fwindows\u002Fsyswow64\"",{"type":14,"tag":192,"props":733,"children":734},{"style":199},[735],{"type":20,"value":267},{"type":14,"tag":192,"props":737,"children":738},{"class":194,"line":270},[739],{"type":14,"tag":192,"props":740,"children":741},{"style":199},[742],{"type":20,"value":326},{"type":14,"tag":22,"props":744,"children":745},{},[746,748,754,755,761,762,768,769,775,777,783],{"type":20,"value":747},"Any attempt to bind mount sensitive host structures (",{"type":14,"tag":26,"props":749,"children":751},{"className":750},[],[752],{"type":20,"value":753},"id_rsa",{"type":20,"value":407},{"type":14,"tag":26,"props":756,"children":758},{"className":757},[],[759],{"type":20,"value":760},"known_hosts",{"type":20,"value":407},{"type":14,"tag":26,"props":763,"children":765},{"className":764},[],[766],{"type":20,"value":767},"shadow",{"type":20,"value":407},{"type":14,"tag":26,"props":770,"children":772},{"className":771},[],[773],{"type":20,"value":774},"docker.sock",{"type":20,"value":776},") returns a strict ",{"type":14,"tag":26,"props":778,"children":780},{"className":779},[],[781],{"type":20,"value":782},"400 Bad Request",{"type":20,"value":784}," validation error.",{"type":14,"tag":786,"props":787,"children":788},"style",{},[789],{"type":20,"value":790},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}",{"title":7,"searchDepth":255,"depth":255,"links":792},[793,796,802],{"id":41,"depth":237,"text":44,"children":794},[795],{"id":69,"depth":255,"text":72},{"id":159,"depth":237,"text":162,"children":797},[798,799,800],{"id":165,"depth":255,"text":168},{"id":334,"depth":255,"text":337},{"id":551,"depth":255,"text":801},"3. Least Privilege & no-new-privileges",{"id":587,"depth":237,"text":590},"markdown","content:3.security:2.sandboxing-and-hardening.md","content","3.security\u002F2.sandboxing-and-hardening.md","3.security\u002F2.sandboxing-and-hardening","md",1787169590133]