Go Quickstart

go get github.com/nolabs-ai/nono-go

package main

import (
	"log"

	nono "github.com/nolabs-ai/nono-go"
)

func main() {
	caps := nono.New()
	defer caps.Close()

	if err := caps.AllowPath("./data", nono.AccessRead); err != nil {
		log.Fatal(err)
	}
	if err := caps.AllowPath("/tmp", nono.AccessReadWrite); err != nil {
		log.Fatal(err)
	}
	if err := caps.SetNetworkMode(nono.NetworkBlocked); err != nil {
		log.Fatal(err)
	}

	if err := nono.Apply(caps); err != nil {
		log.Fatal(err)
	}

	// The current process is now sandboxed.
}

qc, err := nono.NewQueryContext(caps)
if err != nil {
	log.Fatal(err)
}
defer qc.Close()

result, err := qc.QueryPath("./data/input.json", nono.AccessRead)
if err != nil {
	log.Fatal(err)
}
log.Println(result.Status.String(), result.Reason.String())

network, err := qc.QueryNetwork()
if err != nil {
	log.Fatal(err)
}
log.Println(network.Status.String(), network.Reason.String())

state, err := nono.StateFromCaps(caps)
if err != nil {
	log.Fatal(err)
}
defer state.Close()

data, err := state.JSON()
if err != nil {
	log.Fatal(err)
}

restored, err := nono.StateFromJSON(data)
if err != nil {
	log.Fatal(err)
}
defer restored.Close()

restoredCaps, err := restored.Caps()
if err != nil {
	log.Fatal(err)
}
defer restoredCaps.Close()

if !nono.IsSupported() {
	info := nono.SupportInfo()
	log.Fatalf("sandboxing unsupported on %s: %s", info.Platform, info.Details)
}