Documentation
¶
Overview ¶
-- internal/sandbox/manager.go --
-- internal/sandbox/types.go --
Index ¶
Constants ¶
const ( EnvTimeout = "SFW_SANDBOX_TIMEOUT" // a Go duration, such as 20m EnvMemoryMiB = "SFW_SANDBOX_MEMORY_MIB" // RLIMIT_AS of each process EnvTmpMiB = "SFW_SANDBOX_TMP_MIB" // size of /tmp and RLIMIT_FSIZE )
Environment variables that override the default Limits.
const ( EnvSandboxID = "SFW_SANDBOX_ID" // EnvTypeCache is diff.TypeCacheEnvVar: "rw:DIR" or "ro:DIR" names the // persistent type cache. EnvTypeCache = "SFW_TYPE_CACHE" RuntimeBinary = "runsc" )
Variables ¶
var DefaultLimits = Limits{Timeout: 20 * time.Minute, MemoryMiB: defaultMemoryMiB(), TmpMiB: 2048}
DefaultLimits are the Limits without overrides. The address space is three quarters of the host's memory, so a run fails on its own limit before the host's OOM killer takes the machine.
Functions ¶
func IsSandboxed ¶
func IsSandboxed() bool
Checks if the current process is already running inside the sandbox.
Types ¶
type Capabilities ¶
type Config ¶
type Config struct {
Args []string // Arguments for the internal worker
Mounts []string // List of host paths to bind mount (read only)
WorkDir string // Working directory inside the sandbox
}
Config defines the execution parameters for the sandboxed process.
type Limits ¶ added in v7.5.0
type Limits struct {
// Timeout ends the run, which then fails.
Timeout time.Duration
// MemoryMiB is each process's address space (RLIMIT_AS). Go maps more
// than it touches: a deps diff of helm v4 peaks at 8.9 GiB mapped for
// 7.5 GiB resident.
MemoryMiB uint64
// TmpMiB is the size of the /tmp tmpfs, which holds the build cache and
// a copied signature database, and the largest file a process may
// write (RLIMIT_FSIZE). tmpfs memory counts toward no rlimit.
TmpMiB uint64
}
Limits bound one sandboxed run. gVisor's sentry enforces the rlimits itself, without cgroups, but per process: the sandbox's processes together, and the sentry's own memory, are bounded only by the host.
func LimitsFromEnv ¶ added in v7.5.0
LimitsFromEnv returns DefaultLimits with the overrides the environment sets. A value that does not parse, or is too small, is an error, not the default.
Source Files