{"version":"2.1.90","anchor":"linux-sandbox-improvements","canonical_anchor":"linux-sandbox-improvements","heading":"Linux Sandbox Improvements","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.90\/e\/linux-sandbox-improvements","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.90","markdown":"### Linux Sandbox Improvements\n\n- Mount point cleanup is now deferred when multiple sandboxes are still active, using a reference counter to avoid premature cleanup (search for `\"Deferring mount point cleanup\"`).\n- Added `--unshare-user` flag in certain sandbox configurations for tighter process isolation.\n- Write paths that get wiped by a `denyRead` tmpfs mount are now automatically re-bound (search for `\"Re-bound write path wiped by denyRead tmpfs\"`).\n- Deny path deduplication prevents redundant sandbox mount operations.\n\n**Evidence**\n\nSandbox refcount (search for `\"sandbox(es) still active\"`) and re-bind logic (search for `\"Re-bound write path wiped by denyRead tmpfs\"`)"}