Documentation
¶
Overview ¶
Package local is the dev/self-host workspace provider: a workspace is a directory under --workspace-local-root, and exec runs the command as the chassis's own uid with that directory as HOME and cwd.
There is NO isolation beyond a scrubbed environment and a cwd guard — the command can read anything the chassis uid can. That is why the chassis refuses this provider unless --workspace-allow-local is set explicitly, never implied by --env, and logs a WARN pair at boot.
import _ "github.com/loremlabs/thanks-computer/chassis/workspace/local"
Index ¶
- type Provider
- func (p *Provider) Capabilities() []string
- func (p *Provider) Create(_ context.Context, spec workspace.Spec) (workspace.Handle, error)
- func (p *Provider) Destroy(_ context.Context, h workspace.Handle) error
- func (p *Provider) Name() string
- func (p *Provider) ReachesGrants() bool
- func (p *Provider) Root() string
- func (p *Provider) Sleep(context.Context, workspace.Handle) error
- func (p *Provider) Status(_ context.Context, h workspace.Handle) (workspace.Status, error)
- func (p *Provider) Wake(_ context.Context, h workspace.Handle) (workspace.Computer, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider keeps every workspace under root.
func New ¶
New creates (if needed) and resolves the root directory. Symlinks in the root are resolved once here so the cwd guard compares real paths.
func (*Provider) Capabilities ¶
func (*Provider) Destroy ¶
Destroy removes the directory. Guarded to the root so a forged handle cannot remove anything else.
func (*Provider) ReachesGrants ¶ added in v0.2.31
ReachesGrants: a local workspace's commands run on this machine, as this user, so they reach the chassis's grant socket and its mounted files.
Source Files