Introduction

sandcastle is a worker that runs jobs from sources you do not trust. It pulls self-contained jobs from configured sources, runs each with one capability from a closed toolbox, sends the result back and keeps a record. It only makes outgoing calls and listens on no port.

It started with a site I built that needed data living only inside my home network. sandcastle is how that data gets out safely, without exposing the home network.

The parts

flowchart TD
    core["core<br/>no secrets"]
    box["box<br/>one per job, no network"]
    keep["keep<br/>holds the secrets"]
    gate["gate<br/>the only way out"]
    dest["destinations"]
    core -- "stdin / stdout" --> box
    core -- "Unix socket" --> keep
    keep -- "sandcastle-link" --> gate
    gate -- "sandcastle-egress" --> dest

The core, with no secrets, speaks to a box of its own for each job through its stdin and stdout, and to the keep over a Unix socket; the keep, which holds the secrets, reaches the gate on sandcastle-link; and the gate, the only way out, reaches the destinations on sandcastle-egress.

The promise

A source you configured, or the content of one of its jobs, cannot:

• read your keys or tokens;
• reach your internal network, by a redirect or by DNS;
• leave anything on your machine that outlives the job.

The promise says it in full, and the threat model says what lies outside it.

Where to go next

• To run sandcastle, start with Install and Your first job.
• To write a source, read How a source talks to sandcastle and The source contract.
• To judge its security, read The promise, the threat model and the test matrix.
• To look something up, go to the Reference.