# pisol
Run a command in a Linux or macOS sandbox for the current directory.
```sh
pisol COMMAND [ARG...]
pisol -- COMMAND [ARG...]
```
Run `pisol` with no arguments to edit `.isolate`.
## Requirements
- Bash
- CHICKEN Scheme 5.4 or later
- Make
- A sandbox backend for the host:
- Linux: [Landrun](https://github.com/Zouuup/landrun)
- macOS: `sandbox-exec`
## Build and use
```sh
make build
make tui
pisol COMMAND [ARG...]
```
`make tui` opens the editor. Add writable directories and outbound TCP ports,
then save with `x`. The editor shows and changes only grants from the local
file. Grants from the global init file apply to every project; edit those in
the global file itself.
The sandbox allows read, write and execute access to the current directory.
It allows writable temporary storage and read access to system runtime files.
Outbound TCP is denied unless configuration allows it. A configured port also
grants the name resolution that port needs.
pisol picks its backend from `uname`. Set `PISOL_BACKEND` to `landrun` or
`seatbelt` to override it.
## Configuration
`.isolate` is trusted Bash. pisol loads it after the optional global init file.
```bash
args+=(
--rwx "/path/to/shared"
--connect-tcp 443
)
```
Both files use one grant vocabulary on every platform, so a saved `.isolate`
stays valid across backends. A grant that a backend cannot express is reported
as an error rather than dropped.
Set `ISOLATE_EXTRA_CONFIG` to use a different local file. Set
`PISOL_INIT_CONFIG` to use a different global init file. The default global
path is `~/.config/pisol/init`.
Saving creates a static argument list. It removes comments and dynamic shell
code from the local file.
`NO_COLOR=1` disables editor colour. `ISOLATE_ENV` prevents nested sandboxes.
Run `make copy-config` to create the global init file from the shipped default.
## Install
```sh
make test
make install
```
`make install` uses `/usr/local`. Set `PREFIX`, `DESTDIR`, `BINDIR`,
`LIBEXECDIR`, `MANDIR` or `CSC` to change build or install paths.
