{"version":"2.1.223","anchor":"linux-sandbox-skips-redundant-blocking-mounts-inside-read-on","canonical_anchor":"linux-sandbox-skips-redundant-blocking-mounts-inside-read-on","heading":"Linux sandbox skips redundant blocking mounts inside read-only denied directories","tier":"notice","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.223\/e\/linux-sandbox-skips-redundant-blocking-mounts-inside-read-on","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.223","markdown":"### Linux sandbox skips redundant blocking mounts inside read-only denied directories\n\nThe Linux sandbox skips pointless blocking mounts, so sandboxed runs start with less overhead.\n\n**What**\n\nThe bubblewrap argument builder now recognises when a non-existent deny path already sits inside a read-only denied directory and stops adding a mount to block it.\n\n**Details**\n\n- new bookkeeping tracks write roots and their realpaths, deny directories and their realpaths, and a map of deny paths per allowed root\n- in the redundant case it no longer mounts `\/dev\/null` or an empty temp dir to prevent creation, and logs that the path is already uncreatable\n- Linux sandbox only\n\n**Evidence**\n\n`Skipping non-existent deny path inside a read-only denied directory (already uncreatable)`\n\n- Area: Sandbox\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 0\/5"}