import type { FabricHostCall, FabricKernelRuntime, FabricSandboxOptions, FabricSandboxResult } from "./kernel.js";
export declare const LINUX_BWRAP_ISOLATION_ARGS: readonly ["--ro-bind", "/", "/", "--unshare-all", "--die-with-parent", "--new-session", "--proc", "/proc", "--dev", "/dev"];
export declare const LINUX_BWRAP_SECCOMP_ARGS: readonly ["--seccomp", "4"];
/** A fresh CPython process per call. Only enforce=true adds an OS security boundary. */
export declare class CPythonRuntime implements FabricKernelRuntime {
    readonly binary: string;
    readonly enforce: boolean;
    constructor(binary?: string, enforce?: boolean);
    execute(code: string, hostCall: FabricHostCall, options: FabricSandboxOptions): Promise<FabricSandboxResult>;
}
//# sourceMappingURL=cpython-runtime.d.ts.map