Documentation
¶
Overview ¶
Package sandbox provides isolation for untrusted tool/skill execution.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ContainerConfig ¶
type ContainerConfig struct {
Image string
SocketPath string
MemoryBytes int64
CPUQuota int64
NetworkMode string
}
ContainerConfig holds container sandbox configuration.
type ContainerSandbox ¶
type ContainerSandbox struct {
Image string
// Resource limits
MemoryBytes int64
CPUQuota int64
NetworkMode string
// contains filtered or unexported fields
}
ContainerSandbox implements Sandbox using Docker Engine API for production-grade isolation.
func NewContainerSandbox ¶
func NewContainerSandbox(cfg ContainerConfig) *ContainerSandbox
NewContainerSandbox creates a Docker-based sandbox.
func (*ContainerSandbox) Close ¶
func (c *ContainerSandbox) Close() error
type ProcessSandbox ¶
type ProcessSandbox struct {
WorkDir string
}
ProcessSandbox runs commands in a subprocess with timeouts. For production, replace with container-based isolation (gVisor, Firecracker, etc.).
func NewProcessSandbox ¶
func NewProcessSandbox(workDir string) *ProcessSandbox
func (*ProcessSandbox) Close ¶
func (s *ProcessSandbox) Close() error
Click to show internal directories.
Click to hide internal directories.