Documentation
¶
Overview ¶
Package sandbox holds the container boundary kibble executes inside: the hardening flags every run carries, the metadata hostnames it closes, and the plumbing that names, reaches, and tears down containers. It is separate because it is the security surface, and a security surface buried among a thousand lines of result classification is one nobody reviews.
What it does not claim is as important as what it does. The session runs as root inside the container, because installing the packages a document depends on requires that, and the network stays open, because verifying an install is fetching it. The honest description is a reduced-capability root process on an open network behind the Docker boundary. docs/SECURITY.md owns the full statement.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Args ¶
func Args() []string
hardenedArgs are the docker flags every kibble container runs under. A documented command is text from a repository, which makes it untrusted input, so the container gets no capability the session does not need and bounded memory and process counts. The capabilities kept are the minimal set apt needs, since sessions install Debian packages the docs depend on. Network stays on because verifying an install is fetching it; that is a conscious tradeoff the README's security section owns.
func Available ¶
DockerAvailable reports an error when the docker CLI cannot reach a running daemon, so kibble can fail fast with a clear message instead of reporting every install as a container error.
func Bin ¶
func Bin() string
dockerBin returns the container client binary to invoke. Podman and other drop-in replacements speak docker's command line, so KIBBLE_DOCKER names the binary and docker stays the default.
func Name ¶
func Name() string
containerName returns a container name unique to this process and step.
func RemoveFunc ¶
removeContainerFunc returns the cancel hook for a docker run. Killing the docker client leaves the container running, since the daemon owns it, so the hook removes the container by name before killing the client. Without it an interrupted run leaves containers building in the background.
Types ¶
This section is empty.
Source Files