Skip to content

The sandbox template and the egress allowlist include ASF hosts for every project #1803

New issue
New issue
Closed
#1978
Closed
The sandbox template and the egress allowlist include ASF hosts for every project#1803
#1978
Labels
capability:platformFramework / agent substrate skills (install, verify, doctor, override, status, setup bootstrap)family:docsDocs, MISSION.md, READMEsfamily:setupsetup-* skillsfamily:toolstools/*good first issueGood for newcomerssubstrate:framework-devTool substrate: build / validate / eval the framework itselfsubstrate:sandboxTool substrate: agent isolation, egress control, settings auditsubstrate:setupTool substrate: adopter-side setup state resolved at runtime (lock parsing, floors, fingerprints)

Description

@potiuk
potiuk
opened on Oct 25, 2026

The isolated-setup sandbox template and the network egress allowlist grant ASF hosts (lists.apache.org, cveprocess.apache.org, whimsy and others) to every adopter. That is more network access than a non-ASF project needs. Proposal: split the ASF hosts into a fragment that setup adds only when organization: ASF.

🤖 Generated with Claude Code

Activity

  1. potiuk
    added
    good first issueGood for newcomers
    on Oct 25, 2026

  2. Anurag-S1ngh commented on Oct 25, 2026

    @Anurag-S1ngh
    Anurag-S1ngh
    on Oct 25, 2026
    Contributor

    Hi, I'd like to take this issue. Could you assign it to me?

  3. potiuk
    closed this as completedin #1978on Nov 5, 2026
  4. github-actions
    added
    family:setupsetup-* skills
    family:toolstools/*
    family:docsDocs, MISSION.md, READMEs
    capability:platformFramework / agent substrate skills (install, verify, doctor, override, status, setup bootstrap)
    substrate:sandboxTool substrate: agent isolation, egress control, settings audit
    substrate:framework-devTool substrate: build / validate / eval the framework itself
    substrate:setupTool substrate: adopter-side setup state resolved at runtime (lock parsing, floors, fingerprints)
    on Nov 5, 2026
  5. NekomyaDev
    added a commit that references this issue on Nov 5, 2026

    fix(sandbox): scope ASF network grants to ASF projects (apache#1978)

    7d31a72
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    capability:platformFramework / agent substrate skills (install, verify, doctor, override, status, setup bootstrap)family:docsDocs, MISSION.md, READMEsfamily:setupsetup-* skillsfamily:toolstools/*good first issueGood for newcomerssubstrate:framework-devTool substrate: build / validate / eval the framework itselfsubstrate:sandboxTool substrate: agent isolation, egress control, settings auditsubstrate:setupTool substrate: adopter-side setup state resolved at runtime (lock parsing, floors, fingerprints)

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions