k8s_sandbox

Overview ¶

Example: k8s_sandbox runs an untrusted command as a one-shot Kubernetes Job using the K8s sandbox backend. Each execution creates a hardened Job (non-root, all capabilities dropped, no privilege escalation, read-only root filesystem), waits for it to finish, collects the pod's logs and exit code, and deletes the Job.

This example needs a reachable Kubernetes cluster. It resolves credentials the same way kubectl does: the in-cluster service account when running inside a pod, otherwise your local kubeconfig (KUBECONFIG or ~/.kube/config). With no cluster configured it prints setup guidance and exits cleanly.

# Point kubectl at a cluster first (any of these work):
#   kind create cluster        (https://kind.sigs.k8s.io)
#   minikube start
#   k3d cluster create
go run ./examples/k8s_sandbox/