executor

type BackendDriver ¶

type BackendDriver interface {
	ContainerdClient
	RuntimeReadiness
	io.Closer
}

BackendDriver is the narrow runtime-specific implementation beneath the process-local workload supervisor. Close must synchronously stop and clean every driver workload before it returns.

type ContainerRequest ¶

type ContainerRequest struct {
	ExecutionDigest  string
	ImageDigest      string
	Entrypoint       []string
	WorkingDirectory string
	Environment      map[string]string
	WorkspaceArchive bool
	UserID           uint32
	GroupID          uint32
	ReadOnlyRoot     bool
	NoNewPrivileges  bool
	Network          NetworkMode
	AllowedHosts     []string
	AllowGPU         bool
	Limits           Limits
}

type ContainerdClient ¶

type ContainerdClient interface {
	RunIsolated(context.Context, ContainerRequest, []byte) (Result, error)
}

ContainerdClient is the narrow client an isolated backend must implement. ExecutionDigest is the only permitted runtime-object identity; implementations must reject a second live workload with the same digest and must never derive paths or runtime names from caller payloads. They must also honor context cancellation by stopping and cleaning up the workload before returning. Result and Usage are treated as untrusted input and validated by PolicyExecutor. The CPU-only implementation lives in the separate executor/containerdbackend package and remains an explicit operator choice.

type DenyAll ¶

type DenyAll struct{}

DenyAll makes the bootstrap fail closed until a concrete isolated executor and operator policy are explicitly configured.

func (DenyAll) Execute(context.Context, string, Spec, []byte) (Result, error)

type Executor ¶

type Executor interface {
	Execute(context.Context, string, Spec, []byte) (Result, error)
}

type Limits ¶

type Limits struct {
	CPUMillis      uint64
	MemoryBytes    uint64
	DiskBytes      uint64
	PIDs           uint32
	ExecutionTime  time.Duration
	OutputBytes    uint64
	GPUDeviceCount uint32
}

type Mount ¶

type Mount struct {
	Source string
	Target string
}

type NetworkMode ¶

type NetworkMode string

const (
	NetworkNone      NetworkMode = "none"
	NetworkAllowlist NetworkMode = "allowlist"
)

type Policy ¶

type Policy struct {
	AllowedImages       map[string]struct{}
	AllowedNetworkHosts []string
	MaxAllowedImages    int
	MaxEnvironment      int
	MaxArguments        int
	MaxAllowedHosts     int
	MaxStringBytes      int
	MaxInputBytes       uint64
	Ceiling             Limits
	PermitGPU           bool
	PermitNetwork       bool
	RequireReadOnlyRoot bool
}

Policy is a terminal-owned ceiling. A remote task may request less, never more, and may not enable capabilities absent from this policy.

func (p Policy) Validate(spec Spec) error

func (p Policy) ValidateInput(input []byte) error

type PolicyExecutor ¶

type PolicyExecutor struct {
	// contains filtered or unexported fields
}

PolicyExecutor is a bounded validation and defensive-copy boundary around an audited container runtime client. It does not implement isolation by itself: the supplied client must enforce ContainerRequest in its runtime. The policy is cloned at construction and is safe for concurrent use.

func NewPolicyExecutor(
	policy Policy,
	client ContainerdClient,
) (*PolicyExecutor, error)

func (e *PolicyExecutor) Execute(
	ctx context.Context,
	executionID string,
	spec Spec,
	input []byte,
) (Result, error)

type Result ¶

type Result struct {
	ExitCode int
	Output   []byte
	Usage    Usage
}

type RuntimeReadiness ¶

type RuntimeReadiness interface {
	CheckReady(context.Context) error
}

RuntimeReadiness performs a bounded, cancellation-aware local health check without creating or mutating a workload.

type Spec ¶

type Spec struct {
	ImageDigest         string
	Entrypoint          []string
	WorkingDirectory    string
	Environment         map[string]string
	WorkspaceArchive    bool
	ReadOnlyRoot        bool
	Network             NetworkMode
	AllowedHosts        []string
	AllowGPU            bool
	UserID              uint32
	GroupID             uint32
	Privileged          bool
	NoNewPrivileges     bool
	HostMounts          []Mount
	ExposeRuntimeSocket bool
	Limits              Limits
}

type SupervisedBackend ¶

type SupervisedBackend struct {
	// contains filtered or unexported fields
}

SupervisedBackend bounds active runtime identities before a request reaches a future containerd driver. It creates no goroutine or admission queue: requests above the fixed capacity fail immediately.

func NewSupervisedBackend(
	driver BackendDriver,
	maxActive int,
) (*SupervisedBackend, error)

func (b *SupervisedBackend) CheckReady(ctx context.Context) error

func (b *SupervisedBackend) Close() error

func (b *SupervisedBackend) RunIsolated(
	ctx context.Context,
	request ContainerRequest,
	input []byte,
) (Result, error)

type Usage ¶

type Usage struct {
	CPUMillis   uint64
	PeakMemory  uint64
	DiskWritten uint64
	Duration    time.Duration
}