Documentation
¶
Overview ¶
Package teamenv is the receiving side of a team agent's entrypoint contract (platforms/agent/harness): credentials on ORB_SECRETS_FD and ORB_AUTH_FD, never in the environment or files the agent's tools could open, and a process its same-user tools cannot inspect.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AuthDocument ¶
AuthDocument is auth.json on ORB_AUTH_FD, a file the entrypoint opened as root: this process reads and rewrites it, and nothing it starts can open it, /proc/self/fd included, since reopening checks the file's own permissions. It wraps the descriptor once per process: the state can be opened twice (a first start migrates), and a second *os.File would leave the first to be collected, closing the descriptor under it.
func Hide ¶
func Hide()
Hide makes this process non-dumpable: its /proc entries, environ included, become root's, so tools running as the same user cannot read the credentials it was started with. Its children are dumpable again after exec.
func LoadSecrets ¶
func LoadSecrets() error
LoadSecrets reads KEY=VALUE lines from ORB_SECRETS_FD into this process's environment. /proc/self/environ, which the agent's read tool could open, shows only the environment the process started with.
Types ¶
This section is empty.
Source Files