isolation

package
v0.3.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 19, 2026 License: Apache-2.0 Imports: 16 Imported by: 0

Documentation

Overview

Package isolation owns the executor's local compiler and guest processes.

Index

Constants

This section is empty.

Variables

View Source
var (
	ErrCompileWorker   = errors.New("compiler worker failed")
	ErrCompileBudget   = errors.New("compilation resource budget exceeded")
	ErrExecutionBudget = errors.New("execution resource budget exceeded")
	ErrAdmission       = errors.New("compiler capacity unavailable")
	ErrWorker          = errors.New("guest worker failed")
)

Functions

This section is empty.

Types

type Config

type Config struct {
	Profile                   string `toml:"profile"`
	CgroupRoot                string `toml:"cgroup_root"`
	NodeMemoryBytes           int64  `toml:"node_memory_bytes"`
	NodeCPUQuotaUS            int64  `toml:"node_cpu_quota_us"`
	NodePIDs                  int64  `toml:"node_pids"`
	ControlMemoryReserveBytes int64  `toml:"control_memory_reserve_bytes"`
	ControlCPUReserveUS       int64  `toml:"control_cpu_reserve_us"`
	CompileMemoryBytes        int64  `toml:"compile_memory_bytes"`
	CompileCPUQuotaUS         int64  `toml:"compile_cpu_quota_us"`
	CompileWallMS             int64  `toml:"compile_wall_ms"`
	CompileConcurrency        int    `toml:"compile_concurrency"`
	CompileQueue              int    `toml:"compile_queue"`
	RunMemoryBytes            int64  `toml:"run_memory_bytes"`
	RunCPUQuotaUS             int64  `toml:"run_cpu_quota_us"`
	RunWallMS                 int64  `toml:"run_wall_ms"`
	WorkerPIDs                int64  `toml:"worker_pids"`
	MemoryPages               uint32 `toml:"memory_pages"`
}

Config is explicit for the shared Linux profile. Empty/trusted keeps the local in-process engine, which does not provide hard CPU/memory isolation. CPU values are microseconds per 100ms; memory includes the Go worker itself.

func (Config) Shared

func (c Config) Shared() bool

func (Config) Validate

func (c Config) Validate() error

type Process

type Process struct {
	// contains filtered or unexported fields
}

Process is a private, single-run child. Only Close releases its reservation; caller timeout or worker exit alone cannot make capacity available again.

func (*Process) BudgetExceeded

func (p *Process) BudgetExceeded() bool

func (*Process) Close

func (p *Process) Close() error

func (*Process) Compiled

func (p *Process) Compiled()

func (*Process) Done

func (p *Process) Done() <-chan struct{}

func (*Process) RunLimits

func (p *Process) RunLimits() error

type Supervisor

type Supervisor struct {
	// contains filtered or unexported fields
}

Supervisor belongs to the node, not a reconnecting session. Reservations cover the larger phase memory limit until the process is reaped and its cgroup is removed, so aggregate pressure cannot select a healthy sibling.

func New

func New(c Config) (result *Supervisor, resultErr error)

func (*Supervisor) Close

func (s *Supervisor) Close() error

func (*Supervisor) Config

func (s *Supervisor) Config() Config

func (*Supervisor) Start

func (s *Supervisor) Start(ctx context.Context, child *os.File, argument string) (result *Process, resultErr error)

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL