feat: set sandbox HOME directory to /sandbox instead of /tmp

Co-Authored-By: Claude <noreply@anthropic.com>

Author: koki-develop

e2e/tests/security/go_runtime_attack.yml

@@ -206,9 +206,9 @@ tests:
               status: "OK"
               signal: null
             run:
-              stdout: "HOME=/tmp\nPATH=/usr/bin:/bin\n"
+              stdout: "HOME=/sandbox\nPATH=/usr/bin:/bin\n"
               stderr: ""
-              output: "HOME=/tmp\nPATH=/usr/bin:/bin\n"
+              output: "HOME=/sandbox\nPATH=/usr/bin:/bin\n"
               exit_code: 0
               status: "OK"
               signal: null

internal/sandbox/configs/nsjail.cfg

@@ -38,7 +38,7 @@ clone_newnet: true
 iface_no_lo: true
 
 # HOME must be set because many tools read it for config/cache paths.
-envar: "HOME=/tmp"
+envar: "HOME=/sandbox"
 
 # Static rlimits (constant across all runtimes and execution steps).
 # Each requires an explicit _type: VALUE because the protobuf defaults

internal/sandbox/execution.go

@@ -70,7 +70,7 @@ func (e *execution) buildArgs() []string {
 	)
 
 	// Runtime-specific environment variables (e.g. PATH, GOROOT).
-	// HOME=/tmp is set in the config file.
+	// HOME=/sandbox is set in the config file.
 	for _, env := range e.env {
 		args = append(args, "-E", env)
 	}