mhoennigandClaude Fable 5
2abde3aec9
The full five-way evaluation (bash, Python 3, Kotlin Native, Rust, Go) with the numeric scoring, the Kotlin Native deep-dive, and the own-namespaces-instead-of-bwrap analysis, ending in a concrete proposal: Go, stdlib-only, one static binary, sandbox engine behind an interface so bwrap can later be swapped for native namespaces. Status proposed — the decision outcome is recorded once made. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1.2 KiB
Werkdock
A docker-like sandbox CLI over bwrap — filesystem isolation only.
A dock is the enclosed basin in which ships are built: the dock gate controls what passes, the water outside is shared with the whole harbor.
Accordingly, network, uid, /proc, /dev, and /tmp come from the host by contract; that is what makes Werkdock work without root on a Hostsharing Managed Webspace.
Semantics:
- An image is a rootfs archive.
- An instance is an unpacked, writable directory tree.
werkdock run <instance> -- <command>executes in the sandbox with uid 0 mapped to the calling user.werkdock doctorchecks the host: user-namespace capability, disk and quota headroom.
Status: bootstrap. The implementation language is proposed in RFC 0001 (Go). Werkdock grows in this subdirectory of the Werkator repository and moves to its own repository once it stands on its own. It must stay self-contained: no imports from Werkator code, no Gradle coupling to the Werkator build. The roadmap is session B of docs/plan/21-werkdock-extraction-and-webspace-install.md.