{% comment %}
The no-sandbox warning, included on every plugin page.

It is deliberately plain about what a plugin can do.  Softening this would make
the acknowledgement checkbox on the enable dialog meaningless — an administrator
cannot consent to a risk nobody described.
{% endcomment %}
<div class="alert cp-plugin-warn d-flex gap-3 align-items-start" role="note">
  <i class="fas fa-triangle-exclamation fa-lg mt-1" aria-hidden="true"></i>
  <div>
    <strong>Plugins are not sandboxed.</strong>
    A plugin is Python code that runs inside the panel process. It shares this
    panel's database connection, its configuration and its access to the root
    daemon, so it can read and change every customer's data on this server.
    There is no meaningful way to contain that without running plugins in a
    separate process, and CloudPanel does not do that today.
    <div class="small mt-1">
      Install a plugin only if you trust its author the way you would trust
      someone with a root shell on this machine. Verify the checksum you were
      given by the author before installing, and read the code.
    </div>
  </div>
</div>