sandbox

package
v0.1.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 1, 2026 License: MIT Imports: 2 Imported by: 0

Documentation

Overview

Package sandbox wraps game/agent subprocesses with per-session isolation and resource limits (PRD §7 S2). It prefers bubblewrap, falls back to prlimit, and degrades to a plain exec with a warning.

Index

Constants

This section is empty.

Variables

View Source 
var DefaultLimits = Limits{CPUSeconds: 3600, MemoryMB: 512, MaxProcs: 64}

DefaultLimits suit a single interactive game session.

Functions

This section is empty.

Types

type Limits 

type Limits struct {
	CPUSeconds int // hard CPU-time cap (fork-bomb/runaway protection)
	MemoryMB   int
	MaxProcs   int
}

Limits are per-process resource caps.

type Mode 

type Mode string

Mode selects the isolation technology. 

const (
	ModeAuto    Mode = "auto"
	ModeBwrap   Mode = "bwrap"
	ModePrlimit Mode = "prlimit"
	ModeNone    Mode = "none"
)

type Runner 

type Runner struct {
	// contains filtered or unexported fields
}

Runner builds sandboxed exec.Cmds.

func New 

func New(mode Mode) *Runner

New picks the best available mode when ModeAuto is requested.

func (*Runner) Command 

func (r *Runner) Command(workDir, program string, args ...string) *exec.Cmd

Command wraps program+args in the runner's sandbox. workDir is the only writable path (savegames land there); everything else is read-only.

func (*Runner) Mode 

func (r *Runner) Mode() Mode

Mode reports the active isolation mode.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.