update 26.7.26

2026-07-26 01:45:10 +08:00
parent e8311e5096
commit f2a66cb39d
76 changed files with 5619 additions and 0 deletions
@@ -0,0 +1,16 @@
+# ------------------------------
+# Dify Agent Local Sandbox Configuration
+# ------------------------------
+
+# Set to false to disable Landlock path isolation (default: true).
+SHELLCTL_ENABLE_PATH_ISOLATION=true
+
+# The paths below override the built-in defaults when set, even to an empty value.
+# Leave them commented out to keep the defaults; empty read-only or device path
+# lists can prevent commands from running.
+# Comma-separated additional read-write directories (default: none beyond $HOME).
+# SHELLCTL_LANDLOCK_RW_PATHS=
+# Comma-separated read-only and executable directories (default: /usr,/bin,/sbin,/lib,/lib64,/etc,/proc,/opt/dify-agent-tools,/opt/homebrew,/snap).
+# SHELLCTL_LANDLOCK_RO_PATHS=
+# Comma-separated read-write device files (default: /dev/null,/dev/zero,/dev/urandom,/dev/random,/dev/tty).
+# SHELLCTL_LANDLOCK_RW_DEV_PATHS=