SKILL.md
Nsjail Skill
Linux sandboxing and process isolation using nsjail.
Commands
| Command | Description |
|---|---|
[nsjailconfig](#nsjailconfig) |
Generate nsjail configuration |
[nsjailprofile](#nsjailprofile) |
Generate nsjail profile |
[nsjailrun](#nsjailrun) |
Run command in nsjail |
nsjail_config
Generate an nsjail configuration.
nsjail_profile
Generate an nsjail profile.
nsjail_run
Run a command in nsjail.
Usage Examples
# Generate minimal nsjail config
@omni("nsjail.nsjail_config", {"skill_id": "data-processor", "mode": "local"})
# Generate standard profile
@omni("nsjail.nsjail_profile", {"profile_type": "standard", "skill_id": "web-scraper"})
# Run command in nsjail
@omni("nsjail.nsjail_run", {"cmd": ["python3", "script.py"], "mode": "local"})Concepts
| Topic | Description | Reference |
|---|---|---|
| Profile Types | Sandbox profiles | [profiles.md](references/profiles.md) |
| Resource Limits | CPU/memory limits | [rlimits.md](references/rlimits.md) |
| Network Policies | Network isolation | [network.md](references/network.md) |
Best Practices
- Start with minimal profile, escalate as needed
- Use network deny unless required
- Set appropriate timeouts
- Use cgroups for resource control
Related Skills
| Topic | Description | Reference |
|---|---|---|
| Seatbelt | macOS sandboxing | [seatbelt](../seatbelt/SKILL.md) |
| NCL Modules | Nickel module patterns | [nickel-modules.md](packages/ncl/nickel-modules.md) |