is there a standard way to get extra binaries in the sandbox? Terraform needs some extra tools to run. I can just forward the whole PATH envvar for all requests, but there should be a way that's more respectful of the sandboxing...

Not sure it's the standard way, but when

buf

needed the

diff

binary to run

buf format

I used

BinaryShims

(which other rules used to do similar things): https://github.com/pantsbuild/pants/blob/main/src/python/pants/backend/codegen/protobuf/lint/buf/format_rules.py#L63

Thanks, I'll give that a shot!