# Workload Sandboxing

How Fabric isolates workloads for security

## Overview

Every workload on Fabric runs in a sandboxed environment. This protects:

- Device owners from malicious code
- Job submitters from data leaks
- The network from compromised nodes

* * *

## Sandbox Technology

Fabric uses OS-native sandboxing mechanisms for each platform:

**macOS:**

- Uses Apple built-in sandboxing
- Same technology used by App Store apps
- No additional software required

**Linux:**

- Uses kernel namespaces
- Provides process, network, and filesystem isolation

**Windows:**

- Uses restricted process tokens
- Process group isolation
- Limited system call access

* * *

## What is Restricted

**Network access:**

- Outbound network connections are blocked
- Workloads cannot access the internet
- Cannot communicate with other processes

**Filesystem access:**

- Limited to temporary working directory
- Cannot read system files
- Cannot write outside workspace
- Workspace is deleted after job completion

**System calls:**

- Limited to necessary operations
- Cannot access hardware directly
- Cannot spawn unrestricted processes

* * *

## What is Allowed

**Read access:**

- System libraries (for Python packages to work)
- Temporary workspace files
- Input data provided by the job

**Write access:**

- Temporary workspace only
- Output files designated by the workload

**Compute:**

- Full CPU access (within resource limits)
- GPU access (if job requires it)
- Memory up to configured limits

* * *

## Resource Limits

Each job has configurable limits:

- **Timeout:** Maximum execution time (default: 30 minutes)
- **Memory:** Maximum RAM usage
- **CPU:** Process priority

Jobs exceeding these limits are terminated and marked as failed.

* * *

## Custom Workloads

Custom workloads uploaded by enterprises run with the same sandboxing.

The sandbox prevents custom code from:

- Accessing the device owner files
- Making network requests
- Persisting data between jobs
- Interfering with other processes

* * *

## Proof of Execution

After each job, the agent generates a Proof of Execution containing:

- SHA256 hash of workload code
- SHA256 hash of input data
- SHA256 hash of output
- Execution timing
- Anonymized node identifier

This provides verification that the job was executed correctly.

* * *

## Privacy Protection

**For device owners:**

- Your personal files are never accessible to workloads
- Your identity is anonymized to job submitters
- Workloads cannot exfiltrate data (no network access)

**For job submitters:**

- Your code and data are processed in isolation
- Other workloads cannot access your data
- Results are uploaded securely