Security in every layer.

Root inside. Nobody outside.

• Seven namespaces per sandbox
• A private, writable overlay
• Only 14 capabilities, no privilege escalation
• Self-checked before it ever runs

Bounded from the very first instruction.

• Memory, CPU and process caps on every box
• One clean kill when it’s done

Fifty syscalls the box simply can’t make.

• Kernel-level filtering on every process
• Blocks mount, ptrace, bpf and io_uring

Every box proves who it is.

• Single-use boot nonce
• Host token never enters the box
• One control channel, no impersonation

A firewall the box can’t touch.

• Per-sandbox proxy and ruleset
• Private ranges and the host sealed off
• Every decision logged

Use a secret without ever storing it.

• Injected into one process only
• Scrubbed from output and logs, even when encoded

$ wb secret exec GITHUB_TOKEN -- sh -c 'echo "$GITHUB_TOKEN"' $ wb secret exec GITHUB_TOKEN -- sh -c 'printf %s "$GITHUB_TOKEN" | base64' 

Scoped keys, shown once, revocable anytime.

• Keys bound to the sandboxes they own
• Browser and DNS-rebinding requests refused
• Brute force rate limited

A tamper-evident record of everything.

• Hash-chained, append-only log
• Verified with one command