# ------------------------------
# Dify Agent Local Sandbox Configuration
# ------------------------------

# Set to false to disable Landlock path isolation (default: true).
SHELLCTL_ENABLE_PATH_ISOLATION=true

# The paths below override the built-in defaults when set, even to an empty value.
# Leave them commented out to keep the defaults; empty read-only or device path
# lists can prevent commands from running.
# Comma-separated additional read-write directories (default: none beyond $HOME).
# SHELLCTL_LANDLOCK_RW_PATHS=
# Comma-separated read-only and executable directories (default: /usr,/bin,/sbin,/lib,/lib64,/etc,/proc,/opt/dify-agent-tools,/opt/homebrew,/snap).
# SHELLCTL_LANDLOCK_RO_PATHS=
# Comma-separated read-write device files (default: /dev/null,/dev/zero,/dev/urandom,/dev/random,/dev/tty).
# SHELLCTL_LANDLOCK_RW_DEV_PATHS=