sandbox

type Backend string

type BindMount struct {
	Source   string
	Target   string
	ReadOnly bool
}

type Config struct {
	Backend Backend `json:"backend"`
	WorkDir string  `json:"work_dir,omitempty"`
	// Container-specific
	Image   string `json:"image,omitempty"`
	Network string `json:"network,omitempty"`
	// Runtime selects a hardened OCI runtime for the container backend
	// (e.g. "runsc" for gVisor, "kata-runtime"). Empty uses the daemon default.
	Runtime string `json:"runtime,omitempty"`
	// K8s-specific
	Namespace  string `json:"namespace,omitempty"`
	ServiceAcc string `json:"service_account,omitempty"`
	// WASM-specific
	WASMPath string `json:"wasm_path,omitempty"`
}

type ContainerConfig struct {
	Image       string
	SocketPath  string
	MemoryBytes int64
	CPUQuota    int64
	NetworkMode string
	// Hardening. Zero values fall back to hardened defaults.
	User           string
	PidsLimit      int64
	NofileLimit    int64
	NprocLimit     int64
	CapAdd         []string
	SeccompProfile string
	// Runtime selects a hardened OCI runtime such as "runsc" (gVisor) or
	// "kata-runtime". Empty uses the daemon default (runc). It is never required.
	Runtime string
	// Tmpfs overrides the default writable /tmp mount. Nil uses the default.
	Tmpfs map[string]string
	// WritableRootfs disables the read-only rootfs hardening when true.
	WritableRootfs bool
	Mounts         []BindMount
	WorkingDir     string
	Env            []string
}

type ContainerPool struct {
	// contains filtered or unexported fields
}

type ContainerSandbox struct {
	Image string

	// Resource limits
	MemoryBytes int64
	CPUQuota    int64
	NetworkMode string
	// Hardening
	User           string            // non-root user/uid:gid the workload runs as
	PidsLimit      int64             // max processes inside the container
	NofileLimit    int64             // RLIMIT_NOFILE (open files)
	NprocLimit     int64             // RLIMIT_NPROC (processes/threads)
	ReadonlyRootfs bool              // mount the container root filesystem read-only
	CapAdd         []string          // capabilities to re-add on top of CapDrop ALL
	SeccompProfile string            // custom seccomp profile JSON; empty keeps Docker's default
	Runtime        string            // OCI runtime (e.g. "runsc" for gVisor, "kata-runtime")
	Tmpfs          map[string]string // writable tmpfs mounts (path -> mount options)
	Mounts         []BindMount       // explicitly granted host paths
	WorkingDir     string            // directory inside the container
	Env            []string          // explicit environment; no host environment inheritance
	// contains filtered or unexported fields
}

type K8sJobConfig struct {
	Image          string
	Namespace      string
	ServiceAccount string
}

type K8sJobSandbox struct{}

type PoolConfig struct {
	// MaxSize is the maximum number of containers in the pool (default 5).
	MaxSize int
	// MaxIdleTime is how long an idle container is kept before being destroyed (default 5m).
	MaxIdleTime time.Duration
	// Factory creates new sandbox instances.
	Factory func() (Sandbox, error)
}

type ProcessSandbox struct {
	WorkDir string
}

type Result struct {
	Stdout   string `json:"stdout"`
	Stderr   string `json:"stderr"`
	ExitCode int    `json:"exit_code"`
}

type Sandbox interface {
	Execute(ctx context.Context, command string, args []string, timeout time.Duration) (*Result, error)
	Close() error
}

type WASMConfig struct {
	WASMPath         string
	MemoryLimitPages uint32
	FSDir            string
}

type WASMSandbox struct{}