mhoennigandClaude Fable 5
e4bfeacf5a
The minimal build-capable CLI decided in RFC 0002's outcome: stdlib-only Go module, one static binary. - engine: RunSpec behind the Engine interface (RFC 0001); the Bwrap engine ports Werkator's hardened invocation — uid-0 mapping, read-only rootfs at /, proc/dev/tmp/root before the user binds so binds below them land inside, mountpoint pre-creation in the rootfs including file mountpoints, and a guard against binds escaping the rootfs. --clearenv gives docker-style clean environments (HOME/PATH set explicitly). - store: images under $WERKDOCK_HOME (default ~/.werkdock), load unpacks via the tar CLI into a tmp dir and renames atomically. - cli: docker-shaped run flags (-v/-e/-w/--rm); refused docker flags (-p, --network, --memory, --cpus, --user, -d) fail loudly with the reason; exit codes follow docker (125 CLI errors, child code through). - doctor: port of werkator-build-prerequisites.sh — userns probe with the three signals, tar/zstd, free space and group-quota headroom via testable df/quota parsers, same PASS/FAIL output. - tests: argv golden test, mountpoint and escape tests, flag refusals, store round trip, doctor parsers — plus real-sandbox integration tests that skip where bwrap or userns are unavailable. Also records in step 21: RFC 0002 levels 2/3 deferred; next goal is sandbox builds of Werkator, Werkbaum, and Werkdock itself. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
38 lines
1003 B
Go
38 lines
1003 B
Go
// Package engine executes sandboxed commands. The CLI verbs are thin
|
|
// frontends over this package, so a later daemon can expose the same
|
|
// logic without duplicating it (RFC 0002).
|
|
package engine
|
|
|
|
// Bind is one bind mount, applied in order; later mounts shadow earlier
|
|
// ones at their own path, exactly as bwrap layers them.
|
|
type Bind struct {
|
|
Source string
|
|
Dest string
|
|
ReadOnly bool
|
|
}
|
|
|
|
// EnvVar is one environment variable; order is preserved.
|
|
type EnvVar struct {
|
|
Key string
|
|
Value string
|
|
}
|
|
|
|
// RunSpec describes one sandboxed command, independent of the engine
|
|
// that executes it.
|
|
type RunSpec struct {
|
|
// RootFS is the absolute path to the unpacked image rootfs,
|
|
// bound read-only at /.
|
|
RootFS string
|
|
Binds []Bind
|
|
Env []EnvVar
|
|
Workdir string
|
|
Command []string
|
|
}
|
|
|
|
// Engine runs a RunSpec and reports the command's exit code.
|
|
// bwrap is the first engine; native namespaces may become a second
|
|
// (RFC 0001).
|
|
type Engine interface {
|
|
Run(spec RunSpec) (int, error)
|
|
}
|