phobos.sh
The entry point: how a run is assembled, which configurations apply, and what the exit status means.
phobos-filesystem.sh
The filesystem layer: how the path sets become Landlock rules, and how to run it on its own.
phobos-networksystem.sh
The network layer: the connect guard, the egress broker, the inbound filter and the Landlock port rules.
phobos-timeoutsystem.sh
The timeout layer: a wall-clock bound the command cannot step out of.
phobos-resourcesystem.sh
The resource layer: the rlimits the policy names, set for the command and nothing else.
phobos-cli.sh
One command line for the sandbox and both pruners, on a host with Docker or inside an image.