Documentation
¶
Overview ¶
Package supervisor owns one sandbox's bounded worker lifecycle. A durable outer service must claim the job before Run and kill its cgroup if this worker dies. This package alone does not provide crash recovery or qualification.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( // ErrOutputLimit means stdout and stderr exceeded their combined byte budget. ErrOutputLimit = errors.New("cortex: sandbox output limit exceeded") // ErrCleanup withholds terminal output until an external reaper proves stop. ErrCleanup = errors.New("cortex: sandbox cleanup is unresolved") )
Functions ¶
func Run ¶
func Run(ctx context.Context, driver Driver, job sandbox.Job, deadline time.Time) (sandbox.Result, error)
Run handles one already-authorized, durably claimed job. Deadline comes from the accepted receipt; the job's wall limit can only shorten it. A returned terminal result reports execution, never correctness. Non-cleanup failures return both that result and an error; ErrCleanup returns no collectible result.
Types ¶
type Driver ¶
type Driver interface {
Prepare(context.Context, sandbox.Job, io.Writer, io.Writer) error
Start(context.Context) error
Wait(context.Context) (int, error)
Cleanup(context.Context) error
}
Driver controls only the selected sandbox. Prepare may create processes even when its response is lost. Cleanup must terminate every descendant and join all output readers before returning nil. Operations must honor their contexts.
func NewContainedRunsc ¶
NewContainedRunsc requires the worker's exact job service membership and puts the payload below that service. It rechecks membership before every control command. The service manager's start fence, kill policy, limits and live qualification still belong to the external adapter. Use NewRunsc only for independently supervised low-level probes or another proven containment host.
func NewRunsc ¶
func NewRunsc(ctx context.Context, cfg RunscConfig) (Driver, error)
NewRunsc checks the Linux/root boundary and deployment pin before constructing a driver. The caller still owns bundle integrity, qualification admission, durable job claims and external process supervision. No program is executed here. This driver must never be used as a host-execution fallback.
func NewWorkspaceRunsc ¶
func NewWorkspaceRunsc(ctx context.Context, cfg RunscConfig, work *workspace.Workspace) (Driver, error)
NewWorkspaceRunsc binds a contained runtime to one live, bounded workspace. Staging must have verified the image and inputs and written WorkspaceSpec to Bundle. The caller must keep the workspace open until runtime cleanup and authorized exports finish. This constructor never executes a workload.
type RunscConfig ¶
type RunscConfig struct {
Binary string
StateRoot string
Bundle string
Rootfs string
Inputs map[string]string
JobDigest string
Manifest deployment.Manifest
DeploymentDigest string
}
RunscConfig comes only from the trusted staging service. Bundle must already contain the exact deny-all OCI spec for JobDigest, a verified image and verified evidence inputs. The bundle and state root are private host-owned directories. No path or deployment manifest may come from a workload's arguments.
Source Files