Documentation
¶
Overview ¶
Package bubblewrap is a Linux-only sandbox provider that wraps the bubblewrap binary (`bwrap`). It builds user/mount/pid/net namespaces per call so a child CLI runs against a read-only root, an isolated /tmp, fresh /dev and /proc, and no network unless explicitly allowed.
Configuration is taken from cwtypes.SandboxSpec.Config:
network bool — true to share host network (default: isolated) bind_rw []string — extra read-write bind mounts (host==sandbox path) bind_ro []string — extra read-only bind mounts beyond the default ro / chdir string — working directory inside the sandbox (default: "/")
Linux only: New returns ErrUnsupportedPlatform on other GOOS values. `bwrap` must be present on PATH at New() time; otherwise New returns ErrBwrapNotFound. Once constructed, Prepare/Instance never re-probe.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( ErrUnsupportedPlatform = errors.New("bubblewrap: unsupported platform (Linux only)") ErrBwrapNotFound = errors.New("bubblewrap: bwrap binary not found in PATH") )
Sentinel errors so callers can distinguish "not Linux" from "bwrap missing".
Functions ¶
This section is empty.
Types ¶
type Options ¶
type Options struct {
// BwrapPath overrides the auto-detected bwrap path. Empty = look up via
// exec.LookPath at New() time.
BwrapPath string
}
Options configures a bubblewrap.Provider.
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider implements sandbox.Provider via bubblewrap.
func New ¶
New constructs a Provider. Returns ErrUnsupportedPlatform on non-Linux, ErrBwrapNotFound if bwrap cannot be located on PATH.
func (*Provider) Prepare ¶
func (p *Provider) Prepare(ctx context.Context, spec cwtypes.SandboxSpec, scripts []sandbox.Script) (sandbox.Instance, error)
Prepare returns an Instance that will exec bwrap on first Instance.Exec. scripts is presently ignored — bubblewrap composes via argv, not by writing entrypoints into a directory like scriptdir.
Source Files