sandbox

type Backend string

type Config struct {
	Backend Backend `json:"backend"`
	WorkDir string  `json:"work_dir,omitempty"`
	// Container-specific
	Image   string `json:"image,omitempty"`
	Network string `json:"network,omitempty"`
	// Runtime selects a hardened OCI runtime for the container backend
	// (e.g. "runsc" for gVisor, "kata-runtime"). Empty uses the daemon default.
	Runtime string `json:"runtime,omitempty"`
	// K8s-specific
	Namespace  string `json:"namespace,omitempty"`
	ServiceAcc string `json:"service_account,omitempty"`
	// WASM-specific
	WASMPath string `json:"wasm_path,omitempty"`
}

type ContainerConfig struct {
	Image       string
	SocketPath  string
	MemoryBytes int64
	CPUQuota    int64
	NetworkMode string
	// Hardening. Zero values fall back to hardened defaults.
	User           string
	PidsLimit      int64
	NofileLimit    int64
	NprocLimit     int64
	CapAdd         []string
	SeccompProfile string
	// Runtime selects a hardened OCI runtime such as "runsc" (gVisor) or
	// "kata-runtime". Empty uses the daemon default (runc). It is never required.
	Runtime string
	// Tmpfs overrides the default writable /tmp mount. Nil uses the default.
	Tmpfs map[string]string
	// WritableRootfs disables the read-only rootfs hardening when true.
	WritableRootfs bool
}

type ContainerPool struct {
	// contains filtered or unexported fields
}

type ContainerSandbox struct {
	Image string

	// Resource limits
	MemoryBytes int64
	CPUQuota    int64
	NetworkMode string
	// Hardening
	User           string            // non-root user/uid:gid the workload runs as
	PidsLimit      int64             // max processes inside the container
	NofileLimit    int64             // RLIMIT_NOFILE (open files)
	NprocLimit     int64             // RLIMIT_NPROC (processes/threads)
	ReadonlyRootfs bool              // mount the container root filesystem read-only
	CapAdd         []string          // capabilities to re-add on top of CapDrop ALL
	SeccompProfile string            // custom seccomp profile JSON; empty keeps Docker's default
	Runtime        string            // OCI runtime (e.g. "runsc" for gVisor, "kata-runtime")
	Tmpfs          map[string]string // writable tmpfs mounts (path -> mount options)
	// contains filtered or unexported fields
}

type K8sJobConfig struct {
	// Image is the container image the Job's pod runs. Required.
	Image string
	// Namespace is where Jobs are created. Empty defaults to "default".
	Namespace string
	// ServiceAccount, when set, is the pod's service account. Empty uses the
	// namespace default.
	ServiceAccount string
}

type K8sJobSandbox struct {
	// contains filtered or unexported fields
}

type PoolConfig struct {
	// MaxSize is the maximum number of containers in the pool (default 5).
	MaxSize int
	// MaxIdleTime is how long an idle container is kept before being destroyed (default 5m).
	MaxIdleTime time.Duration
	// Factory creates new sandbox instances.
	Factory func() (Sandbox, error)
}

type ProcessSandbox struct {
	WorkDir string
}

type Result struct {
	Stdout   string `json:"stdout"`
	Stderr   string `json:"stderr"`
	ExitCode int    `json:"exit_code"`
}

type Sandbox interface {
	Execute(ctx context.Context, command string, args []string, timeout time.Duration) (*Result, error)
	Close() error
}

type WASMConfig struct {
	// WASMPath is the filesystem path to the .wasm module to run. Required.
	WASMPath string
	// MemoryLimitPages caps the module's linear memory in 64 KiB pages. Zero
	// applies defaultWASMMemoryPages.
	MemoryLimitPages uint32
	// FSDir, when set, is mounted read-write at the module's root ("/"). Empty
	// grants the module no filesystem access at all.
	FSDir string
}

type WASMSandbox struct {
	// contains filtered or unexported fields
}