This document covers local Loom usage where cf-harness creates local gVisor
sandboxes and selectively exposes host directories to those sandboxes.
It is specifically about host mounts: host paths such as a workspace, cache, or run output directory that become visible inside the sandbox. It is not trying to cover the sandbox root filesystem in general.