Linux sandbox: support safe sandbox-local AF_UNIX sockets (e.g., sccache)

Summary

Please consider supporting safe sandbox-local socket IPC so tools like sccache can work under Linux sandboxing.

Today, strict sandboxing blocks socket operations, which prevents sccache from functioning as RUSTC_WRAPPER.

Goal

Enable local IPC needed by developer tools without reintroducing broad host/network exposure.

Proposed safe model

1. Keep --unshare-net enabled (no external network namespace sharing).
2. Allow AF_UNIX socket creation/connection for sandboxed processes.
3. Deny AF_INET/AF_INET6 socket creation in this mode.
4. Use private sandbox temp/runtime dirs (for example private /tmp tmpfs) so UNIX sockets are sandbox-local, not host-shared.

This allows local daemon-style tools (sccache) to work while keeping network and host-socket exposure constrained.

Why this is useful

• sccache client/server uses local sockets for wrapper↔daemon communication.
• In locked-down sandboxes, builds currently require disabling RUSTC_WRAPPER, losing cache speedups.
• A sandbox-local UDS model preserves performance benefits with tighter boundaries.

Concrete example

A supported pattern could be:

• SCCACHE_SERVER_UDS=/tmp/sccache/sccache.sock
• SCCACHE_DIR=/tmp/sccache/cache

when /tmp is private to the sandbox.

Clarification request

If there is already a recommended configuration for sandbox-local AF_UNIX IPC that works with sccache, please document it.