If your CI executes code that contributors send you, a plain container is not

a boundary. Run it under gVisor with the network off and a read-only root

filesystem, keep a syscall trace, and treat everything else (timeouts, what

you mount in, your tokens) as separate problems. This is what the

kadet-hub gate does to compile contributor-supplied Kapitan generators ,

and the pieces transfer to any project that runs plugins, formatters, test

code or build scripts from a pull request.

The problem

A pull request that adds a generator ships Python that the gate has to run to

see what it produces. The same shape shows up anywhere CI runs contributor

code: a linter plugin, a pytest suite, a Terraform provider, a code

formatter. Once that code runs, in-language guardrails do not hold, because

the attacker writes the code and picks the API.

Three defenses that look like confinement are not.…