Documentation
¶
Overview ¶
Package runner is the go-native sandbox runner. It replaces the former bash trio (outer.sh / setup.sh / inner.sh): runner-outer launches pasta, which runs runner-inner (in pasta's user+net namespace), which clones runner-inner-child (CLONE_NEWUSER|CLONE_NEWNS) to lay out the mount namespace, pivot_root, and exec the agent.
The syscall-heavy work lives in runner_linux.go; this file holds the portable helpers (spec decoding, pasta argv, signal mapping, guard evaluation) so they can be unit-tested off the syscall path.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func RunInner ¶
RunInner is the `boid runner-inner` entry point. It runs inside pasta's user+net namespace (inner uid 0). It applies the nft egress rules, then clones runner-inner-child into a fresh user+mount namespace. Mirrors the former setup.sh's nft + `unshare --user … --root` hand-off.
func RunInnerChild ¶
RunInnerChild is the `boid runner-inner-child` entry point (L3). It runs in the cloned user+mount namespace, lays out the sandbox root via bind mounts, pivot_root's into it, writes the context files, runs the agent, and posts the broker job-done. Mirrors the former inner.sh.
func RunOuter ¶
RunOuter is the `boid runner-outer` entry point. It runs on the host as the daemon's direct child and manages the pasta lifecycle: it launches `pasta … -- boid runner-inner`, captures pasta's own stderr to a temp file (dumped only on failure), then performs host-side cleanup of the sandbox ROOT and staging dirs after pasta returns. Mirrors the former outer.sh.
Types ¶
type State ¶
type State struct {
// contains filtered or unexported fields
}
State appends NDJSON diagnostic records to /tmp/boid-<id>-runner-state.json. Each write is a single appended line followed by Sync(), so a panic / kill -9 still leaves the last reached phase flushed on disk. Every method is nil-safe.
func OpenState ¶
OpenState opens (creating) the state file for append. A nil *State (returned when path is empty or open fails) makes all subsequent methods no-ops so the diagnostic path never blocks the run.
Source Files