DataTerminology.comNEW
Running code in an isolated environment to limit potential damage from untrusted inputs.
DESCRIPTION
Sandboxing confines code execution to a restricted environment that limits system access and privileges. It mitigates risks from untrusted or unverified code by isolating processes, filesystems, networks, and syscalls. Browsers, mobile OSes, and server runtimes commonly sandbox plugins and third-party components. Implementations include OS-level namespaces, seccomp filters, and policy-based runtime guards. Sandboxing complements, but does not replace, patching, code review, and least-privilege design.
ALTERNATIVE DEFINITIONS
Wikipedia
In computer security, a sandbox is a security mechanism for separating running programs, often in an effort to mitigate system failures or software vulnerabilities from spreading.
Highlights separation to contain failures or vulnerabilities.
NIST Glossary
A restricted environment used to execute untested code or untrusted programs to prevent harm to the host machine.
Security glossary focus on untested or untrusted code containment.
RELATED TERMS
Trusted Execution Environment Access Control Least Privilege Isolation Browser Sandbox Code Injection Runtime Security Application Whitelisting
COMPETING TERMS
KNOWLEDGE AREAS
Data Security Software Engineering Infrastructure
TARGET AUDIENCE
Security Architect Cybersecurity Engineer Chief Information Security Officer Software Developer DevOps Engineer
EXTERNAL SOURCES
- Wikipedia - Sandbox (computer security)
- NIST Glossary - Authoritative security definition
- Docker - Container isolation and security
- Chromium - Browser sandbox design
TOP QUESTIONS
What problems does Sandboxing solve?
Sandboxing limits the blast radius of compromised or buggy code by isolating it from critical system resources and networks.
Category: Relevancy
How does Sandboxing differ from virtualization?
Sandboxing typically isolates processes within one OS, while virtualization emulates entire machines, providing stronger but heavier isolation.
Category: Comparison
How is Sandboxing implemented on Linux?
Namespaces, cgroups, seccomp-bpf, and AppArmor/SELinux policies restrict process capabilities and surfaces.
Category: HowTo
Is Sandboxing sufficient security on its own?
No. It must complement secure coding, patching, least privilege, and monitoring to form defense-in-depth.
Category: Risk
What are common mistakes with Sandboxing?
Overly permissive policies, forgetting filesystem/network isolation, and neglecting kernel attack surfaces weaken sandboxes.
Category: Mistakes
Where is Sandboxing commonly used?
Web browsers, mobile app containers, plugin runtimes, CI systems, and serverless platforms use sandboxes routinely.
Category: UseCase
How does Sandboxing impact performance?
Minimal to moderate overhead depending on isolation mechanisms. Proper tuning reduces syscall and I/O bottlenecks.
Category: Performance
What is the relationship between Sandboxing and containers?
Containers rely on sandboxing primitives like namespaces and cgroups to isolate workloads.
Category: Concepts
Does Sandboxing help with supply chain risks?
Yes. Isolating third-party code, build steps, and untrusted artifacts reduces compromise impact.
Category: Risk