# CAIN-A75-020 OS Containment Review

**Verdict:** VERIFIED

> Audits an OS sandbox configuration: namespaces, seccomp default-deny and dangerous syscalls, no_new_privs and capabilities, sensitive mounts, egress, resource limits and secret inheritance. It does not start the sandbox.

| Record | Sandbox | Verdict | Failed checks |
|---|---|---|---|
| 0 | bubblewrap | CONTAINED |  |

## What this proves and what it does not
- Proves: the configuration record enables the core namespaces, denies unknown syscalls by default, excludes privileged capabilities and dangerous syscalls, never exposes a sensitive path writable or a container socket, limits resources and inherits no credentials.
- Does not prove: that the sandbox runs as configured, that the kernel is uncompromised, or that a determined kernel exploit is impossible. It is a configuration review.
- Verify offline: `python3 verify_offline.py run.json --pinned-key CRWZZWFnvJTlFISmFAI0Fa4Mqrop3M5IYyoGSoEMh7Q=`