How dgac/padsi works
PADSI is a Linux desktop security package that runs applications in configured, isolated zones and can also manage zone-constrained virtual machines. The principal workflow is: a user launches an application through the PADSI CLI, zone configuration determines its environment and policies, and the per-user runtime starts the application bubble and supporting infrastructure. Network filtering, shared files, visual zone identification, and optional VPN, web-proxy, and VM features extend that workflow. The README documents the product-level flow; sampled source verifies selected networking, proxy, VM-agent, and eBPF components, so uncertain internal wiring is omitted.
Main entry points: run Zone runtime · network_infra.py Network infrastructure · vm VM management · main.rs Bubble init
Components 22
Launch and zones
- PADSI CLI
padsi/cli/client.py - Zone configuration
padsi/config/main.py - Zone runtime
padsi/run
Isolation and files
- Bubble init
crates/init/src/main.rs - Bubblewrap
- Mount policies
padsi/config/mountpoint.py - Data access guard
crates/data-access-guard/data-access-guard/src/main.rs - File access hooks
crates/data-access-guard/data-access-guard-ebpf/src/main.rs
Network controls
- Network policies
padsi/config/network.py - Network infrastructure
padsi/run/network_infra.py - Firewall rules
padsi/fwlib/firewall.py - Host input rules
padsi/system/network_input_manager.py - VPN traffic shapers
padsi/config/trafficshaper.py - Web proxy services
crates/web-infra/src/main.rs
Desktop services
- Wayland proxy
crates/wayland-proxy/src/main.rs - Clipboard policies
padsi/config/clipboard.py - Zone visual feedback
padsi/run/components
Virtual machines
- VM configuration
padsi/config/vm.py - VM management
padsi/run/vm - VM guest agent
crates/vm-agent/src/main.rs
Other components
- Desktop user
- VPN and web services
Connections 22
- Desktop user → PADSI CLI: launches
- PADSI CLI → Zone runtime: requests run
- Zone runtime → Zone configuration: reads policies
- Zone runtime → Bubble init: starts bubble
- Bubble init → Bubblewrap: creates isolation
- Zone runtime → Mount policies: applies mounts
- Bubble init → Data access guard: constrained by
- Data access guard → File access hooks: loads hooks
- Zone runtime → Network infrastructure: starts support
- Network infrastructure → Network policies: reads policies
- Network infrastructure → Firewall rules: configures rules
- Host input rules → Firewall rules: sets input rules
- Network infrastructure → VPN traffic shapers: configures routing
- Network infrastructure → Web proxy services: starts proxy services
- VPN and web services → Web proxy services: serves proxy traffic
- Zone runtime → Wayland proxy: starts proxy
- Wayland proxy → Clipboard policies: enforces sharing
- Zone runtime → Zone visual feedback: provides zone identity
- Desktop user → VM management: manages VMs
- VM management → VM configuration: reads templates
- VM management → VM guest agent: communicates with guest
- VM management → Zone runtime: runs within zone