sandbox

type BindMount struct {
	Src string
	Dst string
}

type Cgroups struct {
	PidsMax     string // --cgroup_pids_max (count; 0 = disabled)
	MemMax      string // --cgroup_mem_max (bytes; 0 = disabled)
	MemSwapMax  string // --cgroup_mem_swap_max (bytes; -1 = disabled, 0 = no swap)
	CpuMsPerSec string // --cgroup_cpu_ms_per_sec (ms per second; 0 = disabled)
}

type CompiledRuntime interface {
	Runtime
	// CompileCommand returns the full command and arguments for the compilation step.
	CompileCommand() []string
	// CompileBindMounts returns read-only bind mounts required during compilation.
	CompileBindMounts() []BindMount
	// CompileEnv returns environment variables for the compilation sandbox in "KEY=VALUE" format.
	CompileEnv() []string

	// CompileLimits returns the nsjail resource limits for the compile step.
	CompileLimits() Limits
}

type Config struct {
	RunTimeout     int // nsjail --time_limit and --rlimit_cpu for the run step, in seconds
	CompileTimeout int // nsjail --time_limit and --rlimit_cpu for the compile step, in seconds
	OutputLimit    int // maximum combined stdout+stderr bytes before killing the process
}

type DefaultFile struct {
	Name    string // filename relative to the working directory (e.g. "go.mod")
	Content []byte
}

type Limits struct {
	Rlimits Rlimits
	Cgroups Cgroups
}

type Result struct {
	Stdout   string  `json:"stdout"`
	Stderr   string  `json:"stderr"`
	Output   string  `json:"output"`
	ExitCode int     `json:"exit_code"`
	Status   Status  `json:"status"`
	Signal   *string `json:"signal"`
}

type Rlimits struct {
	AS     string // --rlimit_as (MiB or "hard")
	Fsize  string // --rlimit_fsize (MiB or "hard")
	Nofile string // --rlimit_nofile (count or "hard")
	Nproc  string // --rlimit_nproc (count, "soft", or "hard")
}

type RunOutput struct {
	Compile *Result
	Run     *Result
}

type Runner struct {
	// contains filtered or unexported fields
}

type Runtime interface {
	// Name returns the runtime identifier.
	Name() RuntimeName

	// Command returns the full command and arguments to execute inside the sandbox.
	// entryFile is the absolute path inside the sandbox (e.g. "/sandbox/index.js").
	// Compiled runtimes may ignore this parameter when the executable path is
	// determined by the compilation step.
	Command(entryFile string) []string

	// BindMounts returns read-only bind mounts required by this runtime
	// (e.g. the runtime installation directory).
	BindMounts() []BindMount

	// Env returns environment variables for the sandbox in "KEY=VALUE" format
	// (e.g. "PATH=/mise/installs/node/24.14.0/bin:/usr/bin").
	Env() []string

	// Limits returns the nsjail resource limits for the run step.
	Limits() Limits

	// RestrictedFiles returns file names that users are not allowed to submit
	// for this runtime (e.g. managed dependency files like go.mod).
	RestrictedFiles() []string
}

type RuntimeName string

type Status string