Under the hoodTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
SandboxArea: what it touches
Internal ChangesKind: in v2.1.227,
Internal ChangesSection of the release
What
Docker, bubblewrap, running as root outside a deliberate sandbox, and "contained with no internet" checks now live in a single class that caches each probe. One gate additionally requires an internal-network probe to come back empty. Its synchronous accessor reports false until the asynchronous checks have settled, so very early callers see the negative answer. The bubblewrap and IS_SANDBOX=1 signals are Linux-only.
Evidence
passesAntDspEnvGateSync
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
