Codecov Report

❌ Patch coverage is 46.25551% with 122 lines in your changes missing coverage. Please review.

📢 Thoughts on this report? Let us know!

Paragon Summary

This pull request review identified 4 issues across 4 categories in 3 files. The review analyzed code changes, potential bugs, security vulnerabilities, performance issues, and code quality concerns using automated analysis tools.

This PR routes local provider jobs through sandboxed execution instead of running them directly, improving isolation for local job runs. It also updates the local provider setup to support the sandbox workflow end to end.

Key changes:

• Local provider jobs now run through sandboxes instead of the old path
• Added a new sandbox.py compute-provider component
• Updated local.py to route local provider job execution via sandbox handling
• Adjusted local provider conda install script for the new sandbox-based flow

Confidence score: 2/5

• This PR has high risk due to 1 critical issue that require immediate attention before merge
• Score reflects critical security vulnerabilities, data loss risks, or system stability issues
• Pay close attention to critical findings and address them before proceeding

3 files reviewed, 4 comments

Severity breakdown: Critical: 1, High: 1, Medium: 1, Low: 1

Tip: @paragon-run <instructions> to chat with our agent or push fixes!

Dashboard

Would it be helpful to use the bwrap wrapper bubblejail? Some reading I did said it will prevent some issues by wrapping bwrap and prevent the issues mentioned above -- kinds of bugs a maintained library would have already caught.

Would it be helpful to use the bwrap wrapper bubblejail? Some reading I did said it will prevent some issues by wrapping bwrap and prevent the issues mentioned above -- kinds of bugs a maintained library would have already caught.

Okay I didnt know about bubblejail will check that out

Would it be helpful to use the bwrap wrapper bubblejail? Some reading I did said it will prevent some issues by wrapping bwrap and prevent the issues mentioned above -- kinds of bugs a maintained library would have already caught.

Ended up sticking with bubblewrap because the others seemed to be nicer if we wanted a more high level GUI solution. Since we have static flags for our sandbox, I ended up sticking with bwrap for more low level access