Documentation
Find the right starting point
Start with the workflow, then follow the model down to its executable format.Start here
QuickstartInstall Warden, confine a first command, add precise authority and preserve MIR plus execution evidence.macOS tutorialInstall Warden on Apple Silicon, run native Seatbelt policies and understand when OCI backends apply.Linux tutorialInstall Warden on Linux, run a first Bubblewrap workload, inspect MIR and receipts, then add mediated networking.Command and process modelHow Warden wraps one command: what it composes, how stdio and signals cross the boundary, why evidence stays out of the workload output, and the isolated fd 3 channel.
Core concepts
ArchitectureThe complete Warden architecture: policy, planner, Executor, sandbox backends, Egress and receipts.PolicyWhy Warden compiles policy into canonical MIR, where that fits in the pipeline, and the shortest path from a policy source to an enforced decision.Sandbox + Executor + EgressSee how portable policy, bounded execution and one network enforcement engine compose per spawn.Backend capability matrixCompare the exact filesystem, network, process, lifecycle and platform guarantees of every backend.
Use Warden
CLI referenceComplete maelys-warden command reference for local and OCI targets, I/O, network frontends, MIR and receipts.C integrationChoose the right C API, compile policies in memory, launch workloads and retrieve sockets and receipts.Integration seamsIntegrate Warden with MCP Runtime, Node isolated launchers, Orchestrator and Sandbox Policy.Isolated Code Mode relayRun a protocol-aware code helper with fd 3, empty environment, private temporary storage and bounded lifecycle.Network mediation and EgressTwo workload frontends, three boundary crossings and one authenticated Egress enforcement engine.
Backends
Apple Container backendsRun digest-pinned OCI workloads in Apple virtual machines, natively or through the Bubblewrap composite.Install Apple Container supportInstall, discover and diagnose the optional Apple Container 1.3 driver package.Krun microVM backendsInstall and operate the optional Krun and Krun+Bubblewrap OCI candidates on Apple Silicon.
Security and evidence
Security modelTrust boundaries, fail-closed guarantees, deliberate limits, descriptor ownership and supply-chain claims.Release integrityVerify signed tags, checksums, attestations and the separation between build and publication authority.Execution receiptsRead execution receipt schemas, capability evidence, lifecycle outcomes and per-connection Egress JSONL records.
Extend and embed
Sandbox Policy adapterMap canonical MIR into Executor plans without sharing private representations or weakening capabilities.Maelys System integrationUnderstand which low-level mechanics come from Maelys System and which lifecycle duties remain in Executor.Author a backendImplement the ABI 10 lifecycle, capability vocabulary, filesystem semantics and descriptor contract.Node.js and PythonRun Warden from dependency-free Node.js and Python facades without duplicating policy or backend logic.
Protocols
Engineering records
Apple Container design recordThe reviewed architecture, implementation milestones and physical conformance gates behind the Apple backend.Release 0.7.0 archiveHistorical release scope, compatibility, gates and deliberately deferred work.Release 0.1.0 archiveHistorical first-release mechanics, validation and deliberate limits before the Warden product facade.