# buildbox-casd-wrap

Sandboxing wrapper to add a restricted buildbox-casd UNIX socket to a custom
bubblewrap sandbox.

```
Usage: buildbox-casd-wrap
   --help                      Display usage and exit.
   --version                   Print version information and exit. [optional]
   --remote                    URL for all services [optional]
   --instance                  Instance for all services [optional]
   --server-cert               Server TLS certificate for all services (PEM-encoded) [optional]
   --client-key                Client private TLS key far all services (PEM-encoded) [optional]
   --client-cert               Client TLS certificate for all services (PEM-encoded) [optional]
   --access-token              Authentication token for all services (JWT, OAuth token etc), will be included as an HTTP  Authorization bearer token [optional]
   --token-reload-interval     Default access token refresh timeout [optional]
   --googleapi-auth            Use GoogleAPIAuth for all services [optional]
   --retry-limit               Retry limit for gRPC errors for all services [optional]
   --retry-delay               Retry delay for gRPC errors for all services [optional]
   --retry-on-code             gRPC status code(s) as string(s) to retry on for all services, e.g. 'UNKNOWN', 'INTERNAL' [optional]
   --request-timeout           Timeout for gRPC requests for all services  (set to 0 to disable timeout) [optional]
   --min-throughput            Minimum throughput for gRPC requests for all services, bytes per seconds. The value may be suffixed with K, M, G or T. [optional]
   --keepalive-time            gRPC keepalive pings period for all services (set to 0 to disable keepalive pings) [optional]
   --load-balancing-policy     gRPC load balancing policy for all services (valid options are 'round_robin' and 'grpclb') [optional]
   --log-level                 Log level (debug, error, info, trace, warning) [optional, default = "error"]
   --verbose                   Set log level to 'debug' [optional]
   --root                      Path to sandbox root directory (defaults to '/proc/PID/root' for bwrap) [optional]
   --socket-path               Path in sandbox for buildbox-casd's UNIX socket [required]
     bwrap/userchroot command  POSITIONAL [required]
```

For non-bubblewrap sandboxes, `--root` is required.

## Example Usage

`buildbox-casd-wrap --remote=unix:///host-casd.sock --socket-path=/tmp/casd.sock -- bwrap --bind myroot / -- bash`
