Zero-Trust Model

The zero-trust principle is simple: start with nothing granted, and explicitly permit only what is needed.

When you run a tool through boks, it lands in a container that has:

  • No network access — the container has no network interface
  • Read-only filesystem — your working directory is mounted :ro; the tool can read your files but cannot write them
  • Minimal Linux capabilities — all capabilities are dropped (--cap-drop=ALL), then a tiny set re-added so common tools work without dangerous privileges
  • No privilege escalation — --security-opt no-new-privileges prevents the tool from gaining new privileges at runtime
  • An isolated view of the system — the container's PID namespace, mount namespace, and network namespace are all separate from the host

The tool sees only your current directory. It does not see your home directory, your SSH keys, your browser data, or any other files. From inside the container, those paths do not exist.

The list above is a container-wide posture — it applies equally to everything running inside a given container. Most boks-published tools carry a second, independent layer underneath it: a seccomp filter compiled into the binary itself, confining that specific binary to the syscalls it was verified to need. This matters once you start composing tools together (-e) — a container-wide grant like network access doesn't silently extend to every tool sharing that container, only to the ones whose own filter allows it. See Security Layers → Per-binary confinement for how it works.

Why this matters

A standard shell command runs with your full user identity. If you pip install a malicious package, or run a binary from the internet, it can:

  • Read ~/.ssh/id_rsa
  • Read ~/.aws/credentials
  • Scan your home directory for secrets
  • Make outbound connections to exfiltrate data

With boks, the same tool starts in an empty room. It cannot do any of those things unless you explicitly grant each permission.

Explicit grants

You grant permissions per-invocation with flags:

boks --cap net curl https://example.com      # allow this one command to use the network
boks --cap rw python -c "open('x','w')"      # allow this one command to write files

Each flag is a conscious decision. The defaults protect you from mistakes.

Next Security Layers →