Documentation
¶
Overview ¶
Package local is the dev/self-host workspace provider: a workspace is a directory under --workspace-local-root, and exec runs the command as the chassis's own uid with that directory as HOME and cwd.
There is NO isolation beyond a scrubbed environment — the command can read anything the chassis uid can, and `cwd` may name any directory on the machine. That is why the chassis refuses this provider unless --workspace-allow-local is set explicitly, never implied by --env, and logs a WARN pair at boot.
With TXCO_WORKSPACE_LOCAL_EXEC set, a command is not run here at all: it is handed to that prefix program, which runs it on another machine (via.go).
import _ "github.com/loremlabs/thanks-computer/chassis/workspace/local"
Index ¶
- Constants
- type Provider
- func (p *Provider) Capabilities() []string
- func (p *Provider) Create(_ context.Context, spec workspace.Spec) (workspace.Handle, error)
- func (p *Provider) Destroy(_ context.Context, h workspace.Handle) error
- func (p *Provider) Name() string
- func (p *Provider) ReachesGrants() bool
- func (p *Provider) Root() string
- func (p *Provider) Sleep(context.Context, workspace.Handle) error
- func (p *Provider) Status(_ context.Context, h workspace.Handle) (workspace.Status, error)
- func (p *Provider) Wake(_ context.Context, h workspace.Handle) (workspace.Computer, error)
Constants ¶
const EnvExec = "TXCO_WORKSPACE_LOCAL_EXEC"
EnvExec names the one setting this provider reads for itself: a command prefix every workspace command is handed to, instead of being run here.
TXCO_WORKSPACE_LOCAL_EXEC="sprite exec -s dev-{name} --"
TXCO_WORKSPACE_LOCAL_EXEC="docker exec -i pony-{name}"
It is how a chassis on a laptop drives a real machine without another provider: the workspace is still a directory here (its bookkeeping, its lease, its name), but a command runs wherever the prefix program puts it. The prefix is whitespace-separated words, no quoting; `{tenant}`, `{stack}` and `{name}` are replaced in each word (a `/` in a name becomes `-`). `txco dev --workspace-local-exec` sets it.
What changes when it is set, and why:
- The command is run as `<prefix…> /bin/sh -c <script>`. The script is the request's command with its variables written in front of it as `export` lines: a process environment does not cross to another machine, so the variables travel inside the command. That includes a run grant's token, which is therefore in the prefix program's argv on this machine. This is the dev posture, as the provider already is.
- The prefix program itself runs with the CHASSIS's environment, not the scrubbed one: it is the operator's own program and needs its login and its configuration (`sprite`, `docker`). Nothing of that environment reaches the command unless the program sends it.
- `cwd` beneath the workspace becomes a `cd` relative to wherever the other machine starts a command (its home); an absolute path outside the workspace is used as given, there.
- The other machine is not made or removed by Create and Destroy, has no stack trees ($TXCO_STACK_DIR), and cannot be dialled (the connect verb) or held open (sessions, a terminal): the provider says so rather than quietly doing those things on this machine.
- Its commands do not reach this chassis's grant socket, so a grant is handed over as a provider elsewhere gets it: the token and the run's name, not the socket.
- A timeout kills the prefix program. What it had started on the other machine may run on; that is the program's to end.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider keeps every workspace under root. via, when set, is the command prefix every command is handed to instead of being run here (via.go).
func New ¶
New creates (if needed) and resolves the root directory. Symlinks in the root are resolved once here so the cwd guard compares real paths.
func NewVia ¶ added in v0.2.41
NewVia is New with a command prefix (see EnvExec); "" runs commands here.
func (*Provider) Capabilities ¶
func (*Provider) Destroy ¶
Destroy removes the directory. Guarded to the root so a forged handle cannot remove anything else.
func (*Provider) ReachesGrants ¶ added in v0.2.31
ReachesGrants: a local workspace's commands run on this machine, as this user, so they reach the chassis's grant socket and its mounted files — unless a prefix hands them to another machine, which gets the token and the run's name and not the socket.
Source Files