Issues

• podman stub: replace /bin/sh script with snug's wrapper, like BROWSER (#669)

  area:policy
  gomoni/snug#691 · Filter by author vyskocilm opened on Oct 22, 2026
  1

• DOCKER_BUILDKIT=1 inside sandbox: measure what unfiltered BuildKit session actually reaches

  area:proxy
  gomoni/snug#690 · Filter by author vyskocilm opened on Oct 22, 2026

• identity.gpg: sandbox gpg client ignores host gpg.conf crypto/trust options (carry an allowlist from gpgconf --list-options)

  area:identityenhancement
  gomoni/snug#689 · Filter by author vyskocilm opened on Oct 22, 2026

• Sandbox ssh verifies the pinned host less strictly than host ssh (accept-new, known_hosts filter drops hashed/@revoked) and silently falls back to compiled defaults

  area:identitybugsev:high
  gomoni/snug#688 · Filter by author vyskocilm opened on Oct 22, 2026

• env coupling and not-granted mark count a path below a single-file grant as granted

  sev:low
  gomoni/snug#686 · Filter by author vyskocilm opened on Oct 22, 2026

• book: document facts #673 removed from .claude/design

  area:docsdocumentation
  gomoni/snug#683 · Filter by author vyskocilm opened on Oct 20, 2026
  2

  

• claude: renew the login on the host (snug-owned PKCE flow) instead of minting a refresh token inside the sandbox

  area:identityenhancement
  gomoni/snug#662 · Filter by author vyskocilm opened on Oct 17, 2026

• login bridge: investigate the browser opener (xdg-open + DISPLAY check vs desktop portal over D-Bus)

  area:identityenhancement
  gomoni/snug#661 · Filter by author vyskocilm opened on Oct 17, 2026

• identity.gh: stage a narrower GitHub token (fine-grained PAT / app token) instead of the gh login's OAuth token

  area:identityenhancementsev:low
  gomoni/snug#648 · Filter by author vyskocilm opened on Oct 14, 2026

• Research: VM-backed isolation (Firecracker, gVisor, Kata, smolvm) — what it would add over bwrap, and what it would cost

  area:supervisorenhancementquestion
  gomoni/snug#631 · Filter by author vyskocilm opened on Oct 6, 2026

• User documentation that cannot drift silently

  area:docssev:low
  gomoni/snug#619 · Filter by author vyskocilm opened on Sep 26, 2026
  1

• Investigate a Zypak-style broker: let a sandboxed app ask snug for a stricter sandbox

  area:supervisorenhancementquestion
  gomoni/snug#584 · Filter by author vyskocilm opened on Sep 17, 2026

• Research: what we can learn from vetto

  gomoni/snug#557 · Filter by author vyskocilm opened on Sep 1, 2026
  1

• Research: what would Landlock add on top of bwrap + seccomp, and what would it cost

  area:policyenhancementquestion
  gomoni/snug#551 · Filter by author vyskocilm opened on Aug 30, 2026
  2

• Idea: snug-in-snug — run a command in a stricter sandbox from inside a sandbox

  area:supervisorenhancementquestion
  gomoni/snug#509 · Filter by author plainsof opened on Aug 28, 2026
  2

• Research: can systemd-nsresourced replace the /etc/subuid + newuidmap requirement for the engine's stage?

  area:supervisorenhancementquestion
  gomoni/snug#482 · Filter by author vyskocilm opened on Aug 28, 2026
  3

• @http-proxy needs a staged adapter for servers that only bind a port (Java, .NET, containers)

  area:proxyenhancement
  gomoni/snug#476 · Filter by author vyskocilm opened on Aug 27, 2026

• Idea: bound the sandbox's memory with a cgroup v2 memory.max, because --size bounds each mount and not their sum

  enhancement
  gomoni/snug#283 · Filter by author vyskocilm opened on Aug 21, 2026
  2

• Idea, needs research: a violation channel via SECCOMP_RET_USER_NOTIF — what the payload TRIED to do, wired to a report and never to a decision

  area:policyenhancementquestion
  gomoni/snug#102 · Filter by author vyskocilm opened on Aug 17, 2026

• Tracker: ergonomics and pre-announcement backlog

  sev:low
  gomoni/snug#36 · Filter by author vyskocilm opened on Aug 13, 2026
  6

• Idea: snug setup, a separate binary with its own go.mod, for profile authoring — AFTER the sandbox is finished

  area:identityenhancement
  gomoni/snug#30 · Filter by author vyskocilm opened on Aug 13, 2026