Support port ranges with --bind-tcp and --connect-tcp

[lneely]

It would be nice to support port ranges with --bind-tcp and --connect-tcp.

[congwang-mk]

Port ranges are useful, but there's a deeper problem: even with ranges, multiple sandboxed processes can't bind the same port without conflicts.

We solved this in sandlock with port virtualization via seccomp user notification. Each sandbox gets a full virtual port space. Multiple sandboxes can bind the same port (e.g., :6379) without conflicts -- no network namespaces, no root required.

How it works: the supervisor intercepts bind()/connect() via seccomp notif. When a port is free, the sandbox binds it directly (zero data-path overhead). When there's a conflict, a different real port is allocated and traffic is forwarded via zero-copy splice. getsockname() returns the virtual port, so the sandboxed process is unaware of the remapping.

sandlock run --port-remap -r /usr -r /lib -r /etc -- redis-server --port 6379
sandlock run --port-remap -r /usr -r /lib -r /etc -- redis-server --port 6379  # no conflict

Landlock net_bind/net_connect port ranges can be layered on top for defense-in-depth (restricting which virtual ports the sandbox may use).

Sandlock also uses Landlock + seccomp-bpf for filesystem/syscall isolation, so the approach is similar to landrun but with the seccomp notif layer on top for features like this.

Disclaimer: I'm the author. Happy to discuss the approach.