Limit Agent filesystem visibility with Linux bubblewrap mount namespaces and workspace-scoped data isolation.

Filesystem Sandbox

The filesystem sandbox places each Agent subprocess and its tools in a Linux bubblewrap (bwrap) mount namespace. It controls filesystem visibility and writability; it does not restrict network access, environment-variable values, or executable permissions.

MOPHEUS_SANDBOX_ENABLED=true

The sandbox is enabled by default, including when this variable is unset or blank. Set it to false or off to disable it; other values also keep the sandbox enabled.

It is effective only on Linux hosts with bwrap installed. Otherwise the daemon logs a warning and runs the task unsandboxed.

Workspace Isolation Boundary

The sandbox isolates by workspace, not by individual task. Tasks in one workspace can collaborate and share required runtime data; data from other workspaces is hidden.

Path or scope	Access	Details
`/`	Read-only	System commands, libraries, and configuration remain readable and executable.
Current task work directory	Read-write	Code, generated files, and task logs.
Other task directories in the current workspace	Read-write	The collaboration scope for tasks in the same workspace.
Current workspace `.repos/<workspaceId>` bare cache	Read-write	Required by worktree `.git` pointers and normal Git operations.
`/tmp`	Read-write	Maps to `/tmp/mopheus-<workspaceId>` on the host and is shared by this workspace.
Other workspaces' task directories and bare caches	Hidden	A tmpfs overlay prevents both reads and writes.
Other host `/tmp` content	Hidden	Only the current workspace temporary directory is remounted.
`$HOME`	Read-write	Provider configuration, sessions, and symlinks continue to work.
Paths in `MOPHEUS_SANDBOX_DENY`	Hidden	Covered by an empty tmpfs.

The sandbox therefore isolates task data across workspaces, but does not isolate tasks within the same workspace or fully isolate $HOME by default.

Sensitive Paths

~/.ssh remains visible by default so SSH Git operations keep working. Hide extra credentials for untrusted agents with comma-separated absolute paths:

MOPHEUS_SANDBOX_DENY=~/.ssh,~/.aws,~/.gnupg

Any operation requiring a hidden credential will fail. Evaluate the minimum credential set together with the task's Git and cloud-access requirements.

Personal Configuration Files

When sandboxing is active, enabled personal configuration files are staged under <WorkDir>/.config/<workspaceId>/<taskId>/. The daemon preserves each file's path relative to $HOME and overlays individual files into the sandbox; the staging directory itself is never mounted.

File modes determine read-only or read-write mounting.
Staging is removed after success, failure, cancellation, timeout, or startup failure.
If sandboxing is unavailable, the task continues without configuration delivery.
Startup cleanup removes only UUID-shaped Mopheus staging roots under .config.

Managed SSH keys and SSH configuration fragments are delivered through this path. Private key bytes are encrypted at rest and are never exposed to browsers; existing host SSH configuration remains unchanged.

Providers and Limits

Supported CLI providers use this outer sandbox on Linux. Codex disables its inner sandbox when this layer is active to avoid nesting. Unsupported providers warn and degrade to unsandboxed execution. See Provider CLI for the capability matrix.

This is a process-level mount sandbox. It can be combined with containers, but does not replace network controls, credential management, access control, or container isolation.

Variable	Default	Description
`MOPHEUS_SANDBOX_ENABLED`	`true`	Enable a `bwrap` mount namespace for Agent subprocesses. Enabled when unset or blank; only `false` or `off` disables it.
`MOPHEUS_SANDBOX_DENY`	—	Additional absolute paths to hide, comma-separated.