.. program:: jetstream server

Basic Sandboxing
================

The simplest form of sandboxing can be set up using the :option:`--sandbox-dir`
command line parameter. This will restrict users accessing the server into the
specified directory.

.. tip::

  Without sandboxing, a transfer of ``/file.txt`` will be stored in ``/file.txt``.

  With sandboxing specified, all files in transfers will be prefixed with the sandbox path. For example, if :option:`--sandbox-dir` is set to ``/storage``, a transfer of ``/file.txt`` will be stored in ``/storage/file.txt``. For more details on path processing, please refer to :doc:`/using_jetstream/where_do_transfers_go`.

If you wish to sandbox users to their individual directories, insert a username
placeholder ``%u`` in the path. The placeholder will then be replaced by each
user's username on the fly. For more information, refer to
:ref:`sandboxing placeholders <sandboxing-file-placeholders>` documentation.

Example:
  If you start the server with :option:`--sandbox-dir` set to ``/home/%u``, each user will be sandboxed into their own home directory.

  When ``userA`` logs in, they will be able to only see files in ``/home/userA``, and the user will perceive this directory as their root directory. Similarly, ``userB`` will be locked into ``/home/userB``.

.. note::

  The sandbox directory path (including any placeholders such as ``%u``, if specified) must exist before users can transfer files.

.. seealso::
  - :doc:`/using_jetstream/where_do_transfers_go`
  - :option:`--sandbox-dir`
  - :doc:`/sandboxing/types/index`
