Documentation
¶
Index ¶
Constants ¶
View Source
const ( SandboxAdapterSchemaV1 = "sandbox-adapter/v1" CapabilityNetworkIsolation = "network.isolated" CapabilityCredentialIsolation = "credentials.hidden" CapabilitySyntheticHome = "home.synthetic" CapabilityWritableBoundary = "filesystem.write-bounded" CapabilityResourceLimits = "resources.bounded" )
View Source
const ( TimeoutExitCode = 124 LimitExitCode = 125 )
View Source
const Redacted = "[REDACTED]"
Variables ¶
View Source
var DefaultLimits = Limits{
CPUSeconds: 300, MemoryBytes: 2 << 30, Processes: 256,
OutputBytes: 8 << 20, WallSeconds: 600, FileBytes: 1 << 30,
}
View Source
var RequiredSandboxCapabilities = []string{ CapabilityCredentialIsolation, CapabilityNetworkIsolation, CapabilityResourceLimits, CapabilitySyntheticHome, CapabilityWritableBoundary, }
Functions ¶
This section is empty.
Types ¶
type Limits ¶ added in v0.4.0
type Limits struct {
CPUSeconds int
MemoryBytes int64
Processes int
OutputBytes int
WallSeconds int
FileBytes int64
}
Limits is adapter-neutral verify resource policy. Zero leaves a dimension unset. Production callers supply non-zero values through DefaultLimits.
type RedactingWriter ¶ added in v0.4.0
type RedactingWriter struct {
// contains filtered or unexported fields
}
func NewRedactingWriter ¶ added in v0.4.0
func NewRedactingWriter(dst io.Writer, secrets []string) *RedactingWriter
func (*RedactingWriter) Close ¶ added in v0.4.0
func (w *RedactingWriter) Close() error
type Redactor ¶ added in v0.4.0
type Redactor struct {
// contains filtered or unexported fields
}
func NewRedactor ¶ added in v0.4.0
type SandboxAdapterV1 ¶ added in v0.4.0
type SandboxAdapterV1 struct {
SchemaVersion string `json:"schema_version"`
Name string `json:"name"`
Platform string `json:"platform"`
Binary string `json:"binary,omitempty"`
Args []string `json:"args,omitempty"`
Capabilities []string `json:"capabilities"`
}
SandboxAdapterV1 is adapter-supplied metadata validated before execution. Binary and Args describe transport only; capabilities decide policy.
func (SandboxAdapterV1) CanonicalCapabilities ¶ added in v0.4.0
func (a SandboxAdapterV1) CanonicalCapabilities() []string
CanonicalCapabilities returns stable order for attestations and reports.
func (SandboxAdapterV1) Validate ¶ added in v0.4.0
func (a SandboxAdapterV1) Validate(production bool) error
Validate negotiates sandbox policy without probing host state. Production accepts only complete capability declarations; unknown claims fail closed.
Click to show internal directories.
Click to hide internal directories.