---
name: "syd-pty"
section: "1"
platform: "linux"
package: "syd"
version: "3.59.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/syd-pty"
---

# syd-pty(1)

PTY to STDIO bidirectional forwarder

## NAME

**syd-pty** - PTY to STDIO bidirectional forwarder

## SYNOPSIS

**syd-pty** *\[-dh\]* *-i \<pty-fd\>* *\[-x \<x-size\>\]* *\[-y \<y-size\>\]*

## DESCRIPTION

Forwards data between given [*pty*(7)](/pty/7.md) main file descriptor and [*stdio*(3)](/stdio/3.md).

## OPTIONS

| | |
| --- | --- |
| **-h** | Display help. |
| **-d** | Run in debug mode without confinement. |
|  | This is permitted only if Syd is built with the **trusted** Cargo feature. |
| **-i** **pty-fd** | PTY main file descriptor. |
| **-x** **x-size** | Specify window row size (default: inherit). |
| **-y** **y-size** | Specify window column size (default: inherit). |

## USAGE

[*syd-pty*(1)](/syd-pty/1.md) is not meant to be used as a standalone tool. Syd invokes [*syd-pty*(1)](/syd-pty/1.md) at startup when PTY sandboxing is set to on with **sandbox/pty:on**. See PTY SANDBOXING section in [*syd*(7)](/syd/7.md) manual page for more information. If you want to use [*syd-pty*(1)](/syd-pty/1.md) in your own project, create a new pseudoterminal with [*posix\_openpt*(3)](/posix_openpt/3.md) or [*openpty*(3)](/openpty/3.md) and pass main end of file descriptor pair to [*syd-pty*(1)](/syd-pty/1.md) with **-i \<pty-fd\>** argument. [*syd-pty*(1)](/syd-pty/1.md) is going to set terminal to raw mode and make no attempt to save/reset original terminal settings which is caller's responsibility.

## IMPLEMENTATION

[*syd-pty*(1)](/syd-pty/1.md) is designed for performance, security, and privacy, using edge-triggered [*epoll*(7)](/epoll/7.md) for event notification and fully asynchronous operations to handle pseudoterminal activities without blocking. It transfers data with zero-copy [*splice*(2)](/splice/2.md), moving bytes directly between file descriptors within kernel without exposing plaintext in user space. Two pairs of pipes carry bidirectional traffic between [*pty*(7)](/pty/7.md) and [*stdio*(3)](/stdio/3.md). execution environment is confined with [*seccomp*(2)](/seccomp/2.md) and [*landlock*(7)](/landlock/7.md), restricting system calls and file access to minimum required.

## SECURITY

[*syd-pty*(1)](/syd-pty/1.md) applies multiple confinement layers to mitigate risks associated with running outside Syd sandbox, preventing potential Meddler-in-the-Middle (MITM) attacks against containers. Linux [*capabilities*(7)](/capabilities/7.md) are dropped early and no-new-privs attribute is set so no unwanted capability leaks into the process. **TOSTOP** flag is set for terminal [*syd-pty*(1)](/syd-pty/1.md) reads from to disable background processes from writing. Resource limits **RLIMIT\_CORE**, **RLIMIT\_FSIZE**, **RLIMIT\_NOFILE**, **RLIMIT\_NPROC**, **RLIMIT\_LOCKS**, **RLIMIT\_MEMLOCK**, and **RLIMIT\_MSGQUEUE** are set to zero to prevent core dumps and file/fd/process/msgqueue creation inside main loop. [*seccomp*(2)](/seccomp/2.md) filters are configured to allow only required syscalls. This list excludes memory, file system and network system calls. [*landlock*(7)](/landlock/7.md) and [*namespaces*(7)](/namespaces/7.md), if available, enforce further restrictions by disallowing all filesystem and network access, providing an additional layer of security. Root directory is moved into */proc/self/fdinfo* with [*pivot\_root*(2)](/pivot_root/2.md) and old root is detached with **MNT\_DETACH**, so no path to host filesystem remains in mount namespace. These combined techniques ensure that even if [*syd-pty*(1)](/syd-pty/1.md) is compromised, scope of malicious actions is significantly limited, maintaining integrity and security of the system.

## ENVIRONMENT

| | |
| --- | --- |
| **SYD\_PTY\_DEBUG** | Run in debug mode without confinement, equivalent to **-d** option. |
|  | This is ignored unless Syd is built with **trusted** Cargo feature. |

## BUGS

[*splice*(2)](/splice/2.md) support for ttys was removed in commit 36e2c7421f02a22f71c9283e55fdb672a9eb58e7 (merged for Linux 6.5) and later restored in commit 9bb48c82aced07698a2d08ee0f1475a6c4f6b266 (merged for Linux 6.6). When running under a problematic Linux kernel [*syd-pty*(1)](/syd-pty/1.md) will exit with 22, aka **EINVAL** or **Invalid argument**. See following links for more information:

- •

  https://git.kernel.org/linus/36e2c7421f02a22f71c9283e55fdb672a9eb58e7

- •

  https://git.kernel.org/linus/9bb48c82aced07698a2d08ee0f1475a6c4f6b266

## SEE ALSO

[*syd*(1)](/syd/1.md), [*syd*(2)](/syd/2.md), [*syd*(7)](/syd/7.md), [*stdio*(3)](/stdio/3.md), [*pty*(7)](/pty/7.md)

**syd** homepage: https://sydbox.exherbo.org/

## AUTHORS

Maintained by Ali Polatel. Up-to-date sources can be found at https://gitlab.exherbo.org/sydbox/sydbox.git and on Radicle at rad:z38HCnbmcDegA2BMxuPaPRPMdp6wF. Bugs/patches can be submitted to https://gitlab.exherbo.org/groups/sydbox/-/issues. Discuss in #sydbox on Libera Chat or in #sydbox:mailstation.de on Matrix.