Documentation
¶
Index ¶
Constants ¶
const MaxBodyBytes = 32 * 1024 * 1024 // 32 MiB
MaxBodyBytes caps body reads to prevent DoS / memory exhaustion.
Variables ¶
This section is empty.
Functions ¶
func Reap ¶
Reap reads the ledger and issues stop+rm to the upstream Docker socket for every resource the job created. Deletion order is containers → networks → volumes (dependency order); exec entries are skipped because they are cleaned up automatically when their container is removed.
Individual stop/rm failures are logged and skipped rather than aborting, so a single stuck container does not prevent the rest from being cleaned up. C5 (cleanupSandboxAfterWait and the GC loop) calls this function.
func ResolveUpstream ¶
ResolveUpstream finds the upstream Docker socket path using this precedence:
- explicit — non-empty value from config (returned as-is, no existence check)
- DOCKER_HOST env var — must be unix:// prefix; TCP returns an error
- $XDG_RUNTIME_DIR/docker.sock — rootless
- /run/user/<uid>/docker.sock — rootless fallback
- /var/run/docker.sock — rootful
Types ¶
type Ledger ¶
type Ledger struct {
// contains filtered or unexported fields
}
Ledger persists Docker resource IDs created by a sandbox job to a JSONL file, enabling both id scope checks and GC (Reap) after the job exits. The file path (runtime directory) is injected by the caller; Ledger itself has no knowledge of the daemon's directory structure.
func NewLedger ¶
NewLedger returns a Ledger backed by the given file path. The file is created on first Append if it does not exist.
func (*Ledger) Append ¶
func (l *Ledger) Append(e ResourceEntry) error
Append writes the entry to the ledger file (append + fsync) before updating the in-memory cache. Callers must call Append before returning the creation response to the client so that "every ID the client knows is in the ledger".
func (*Ledger) Contains ¶
Contains returns true when the ledger holds an entry with the given type and ID.
func (*Ledger) ReadAll ¶
func (l *Ledger) ReadAll() ([]ResourceEntry, error)
ReadAll returns a snapshot of all entries currently in the ledger. Returns nil (not an error) when the ledger file does not exist yet.
type ResourceEntry ¶
type ResourceEntry struct {
Type string `json:"type"` // "container", "network", "volume", "exec"
ID string `json:"id"`
}
ResourceEntry is a single entry in the Docker resource ledger.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server is a Docker API proxy that filters and forwards requests to an upstream Docker daemon via a Unix socket.
func NewWithLedger ¶
NewWithLedger creates a Server with an attached resource ledger. The ledger enables id scope checks (404 for IDs not owned by this sandbox) and write-ahead ID recording from creation responses.
type Verdict ¶
Verdict is the result of a policy check.
func CheckRequest ¶
CheckRequest is the main policy entry point. method is the HTTP method, path is the raw request path (may include API version prefix), body is the request body bytes (may be nil for GET/HEAD).
Source Files