saphan deny-unix-exec
Runs a command under a filter that forbids it, and everything it starts, from creating Unix-domain sockets that could reach a daemon on the host.
Runs a command under a filter that forbids it, and everything it starts, from creating Unix-domain sockets that could reach a daemon on the host. The engine uses it internally to start an agent inside the network wall; it is not something you normally run by hand. Under the filter, creating an AF_UNIX socket, an AF_UNIX datagram socket pair and an io_uring instance fails; stream socket pairs stay allowed because Node, git and shells use them. A network namespace isolates network connections but not a Unix socket on the filesystem, so without this an agent could reach, for example, a session bus or a container runtime on the host. ⚠ There is no best-effort mode: a host that cannot install the filter refuses and starts nothing. The installation setting egress.unix_socket_policy = mask-and-prove stops the engine using this command and relies on masking alone.
Global options apply to every command — see Every command.