Sandbox execution

Dataphin supports sandbox execution to isolate data access in a public cloud Software as a Service (SaaS) environment. When the node scheduling engine starts a node, it runs the node in a built-in sandboxed container. This ensures the security of the node and the service.

The sandboxed container provides the following capabilities:

• Restricted network requests: Prevents user nodes from requesting sensitive services, such as internal Dataphin services.

• Restricted file reads: Prevents user nodes from reading or writing sensitive files, such as the /etc/hosts file.

• Restricted system commands: Prevents user nodes from executing sensitive commands, such as commands to create users.