# Namespace definitions for dexorder AI platform
# - default: gateway, web, and infrastructure services
# - sandbox: per-user sandbox containers (isolated, restricted)
---
apiVersion: v1
kind: Namespace
metadata:
  name: sandbox
  labels:
    app.kubernetes.io/part-of: dexorder
    dexorder.io/type: sandboxes
    # Enforce restricted pod security standards
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted