Support block / allow lists in env vars
Author: jcupittCreated Aug 5, 2026Updated Aug 5, 2026
Labelsenhancement
Eg. perhaps:
export VIPS_BLOCK=VipsForeignLoad
export VIPS_ALLOW=jpegload,pngloadWould disable all loaders, then allow just jpeg and png.
Discussed in https://github.com/libvips/libvips/discussions/5169
Originally posted by tgxworld August 4, 2026 Hi,
Similar to the VIPS_BLOCK_UNTRUSTED env, I'm wondering if a similar env can be added to support setting vips_operation_block_set when using the vips CLI so that I can specify a custom list of loaders which I would like to allow. In my use case, I'm running a Rails application but intentionally avoid ruby-vips and instead shells out to the vips CLI in a child process within a Landlock sandbox that has resource limits configured. Perhaps something like this with an ordered list can be considered?
VIPS_OPERATION_BLOCKS="VipsForeignLoad=true,VipsForeignLoadJpeg=false,VipsForeignLoadPng=false"Thank you for the consideration.
Source: libvips/libvips