Usage · Sandbox

Keep agents in their lane.

Agents run real shell commands as the user DayMug runs as. On Linux, DayMug can wrap every run in a bubblewrap jail, so one person's agent can't read another person's files, the DayMug database or host secrets.

Linux only

bubblewrap does not exist on macOS. Turning the sandbox on there only logs a SECURITY: warning and agents run with no isolation — host DayMug on Linux if you need the jail.

What a jailed agent sees

Path	Access
The conversation's working directory	read and write
System directories (`/usr`, `/etc`, `/opt`, …) and the CLI's own install	read only
The provider account's credential directory	read and write — shared by everyone on the account
`extra_ro_binds` / `extra_rw_binds`	as configured
Other users' folders, your home outside the working directory, the DayMug database	not there at all

The same jail applies everywhere an agent runs: browser chat, IM bots and scheduled tasks. An agent's jail follows the person who owns it.

Turn it on

Install bwrap

sudo apt install bubblewrap      # Debian / Ubuntu
sudo dnf install bubblewrap      # Fedora / RHEL

Enable it in config.yaml and restart

sandbox:
  enabled: true
  type: bwrap
  network: true                     # false = agents run offline
  extra_ro_binds: [/srv/reference]   # everyone may read this
  extra_rw_binds: []                    # everyone may write this — keep it short

All fields: the sandbox reference.

Check the startup log. If bwrap is missing DayMug still starts — so a missing optional binary can't take you offline — but logs a line beginning with SECURITY: and runs with no isolation.
```
grep SECURITY ~/.daymug/logs/daymug.log
```

Who is jailed

Every user is Jailed (work dir only) unless an admin changes it in Settings → Administration → Users → column Sandbox (one user or a batch). Unrestricted means that user's agents reach the whole host filesystem. Admins always run unwrapped.

What changes for users

Skills above the working directory are out of reach — use agent-level or account-level skills.
Network stays on unless network: false.
Shared credential directory — everyone on one provider account can read it, so keep secrets out of it.