runtime

package
v0.0.0-...-973c739 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 23, 2026 License: MIT Imports: 25 Imported by: 0

Documentation

Overview

Package runtime manages container runtime detection and operations.

Index

Constants

View Source 
const DaemonMountsLabelKey = "construct.daemon.mounts_hash"

DaemonMountsLabelKey stores the hash for multi-path daemon mounts.

View Source 
const DefaultWorkspaceEntryBudget = 60000

DefaultWorkspaceEntryBudget is the maximum entry count before triggering confirmation.

Variables

View Source 
var ErrMsbUnsupported = errors.New("unsupported in the msb backend (experimental) — use the docker backend for this feature")

ErrMsbUnsupported marks primitives with no msb equivalent yet (Step 6 MVP scope; docs/VMs.md §7). Callers surface these as clear errors, not silent fallbacks.

View Source 
var ErrWorkspaceRefused = errors.New("workspace refused")

ErrWorkspaceRefused indicates a workspace was rejected by guardrail policy.

Functions

func AppendHostIdentityEnv 

func AppendHostIdentityEnv(env []string) []string

AppendHostIdentityEnv ensures Linux compose commands include host UID/GID for container startup scripts.

func AppendProjectPathEnv 

func AppendProjectPathEnv(env []string) []string

AppendProjectPathEnv ensures CONSTRUCT_PROJECT_PATH is set for compose interpolation.

func AppendRuntimeIdentityEnv 

func AppendRuntimeIdentityEnv(env []string, containerRuntime string) []string

AppendRuntimeIdentityEnv ensures Linux compose commands include host UID/GID and whether the selected runtime uses user-namespace remapping.

func AreAgentsInstalled 

func AreAgentsInstalled() bool

AreAgentsInstalled checks if agent binaries exist in the config directory

func BuildComposeCommand 

func BuildComposeCommand(containerRuntime, configPath, subCommand string, args []string) (*exec.Cmd, error)

BuildComposeCommand constructs a docker-compose command

func BuildImage 

func BuildImage(cfg *config.Config)

BuildImage builds the container image and installs agents if needed.

func CleanupExitedContainer 

func CleanupExitedContainer(containerRuntime, containerName string) error

CleanupExitedContainer removes a stopped container

func ContainerExists 

func ContainerExists(containerRuntime, containerName string) bool

ContainerExists checks if a container exists (running or stopped)

func ContainerHasUIDEntry 

func ContainerHasUIDEntry(containerRuntime, containerName string, uid int) (bool, error)

ContainerHasUIDEntry reports whether /etc/passwd in the container has an entry for uid.

func CreateMsbSandbox 

func CreateMsbSandbox(ctx context.Context, spec *MsbRunSpec) (*msb.Sandbox, error)

CreateMsbSandbox boots a sandbox from a run spec (image must already be loaded via EnsureImage).

func CwdContainerName 

func CwdContainerName(cwd string) string

CwdContainerName returns a deterministic container name derived from the working directory. Same CWD always produces the same name, different CWDs produce independent names, eliminating the singleton conflict.

func DetectRuntime 

func DetectRuntime(preferredEngine string) string

DetectRuntime selects an available container runtime using parallel detection.

func EnforceWorkspace 

func EnforceWorkspace(v WorkspaceVerdict, p WorkspacePolicy) error

EnforceWorkspace checks the verdict against policy, prompting or erroring as needed.

func EnsureCustomNetwork 

func EnsureCustomNetwork(containerRuntime string) error

EnsureCustomNetwork creates the construct-net custom network if it doesn't exist

func EnsureMsbDaemon 

func EnsureMsbDaemon(ctx context.Context, cfg *config.Config, projectDir string) (*msb.Sandbox, error)

EnsureMsbDaemon guarantees the persistent daemon sandbox exists and is running: create when missing, boot when stopped (default workload — the entrypoint + sleep infinity — is re-invoked explicitly; the SDK never auto-runs it, not at create and not at start). Returns the live sandbox.

func EnsureMsbVolumes 

func EnsureMsbVolumes(_ context.Context) error

EnsureMsbVolumes is kept for API compatibility; the packages volume was removed (it shadowed the image's linuxbrew — msb has no Docker-style copy-image-content-into-empty-volume behavior). No named volumes remain.

func ExecInContainer 

func ExecInContainer(containerRuntime, containerName string, cmdArgs []string) (string, error)

ExecInContainer executes a command in a running container and returns output

func ExecInContainerWithEnv 

func ExecInContainerWithEnv(containerRuntime, containerName string, cmdArgs []string, envVars []string, user string) (string, error)

ExecInContainerWithEnv executes a command in a running container with environment variables.

func ExecInteractive 

func ExecInteractive(containerRuntime, containerName string, cmdArgs []string, envVars []string, workdir string) (int, error)

ExecInteractive executes a command interactively in a running container with stdin/stdout/stderr passed through. Returns the exit code.

func ExecInteractiveAsUser 

func ExecInteractiveAsUser(containerRuntime, containerName string, cmdArgs []string, envVars []string, workdir, user string) (int, error)

ExecInteractiveAsUser executes a command interactively in a running container as a specific user. with stdin/stdout/stderr passed through. Returns the exit code.

func ExecNonInteractiveStream 

func ExecNonInteractiveStream(containerRuntime, containerName string, cmdArgs []string, envVars []string, workdir, user string) (int, error)

ExecNonInteractiveStream executes a command in a running container without TTY allocation. Stdout and stderr are streamed separately to the host streams. Returns the container process exit code.

func GenerateDockerComposeOverride 

func GenerateDockerComposeOverride(configPath string, projectPath string, networkMode string, containerRuntime string) error

GenerateDockerComposeOverride creates a docker-compose.override.yml file Uses hash-based caching to skip regeneration when inputs haven't changed

func GetCheckImageCommand 

func GetCheckImageCommand(containerRuntime string) []string

GetCheckImageCommand returns a runtime-specific image inspect command.

func GetComposeFileArgs 

func GetComposeFileArgs(configPath string) []string

GetComposeFileArgs returns compose file args for the runtime.

func GetContainerImageID 

func GetContainerImageID(containerRuntime, containerName string) (string, error)

GetContainerImageID returns the image ID that a container is using

func GetContainerLabel 

func GetContainerLabel(containerRuntime, containerName, labelKey string) (string, error)

GetContainerLabel returns the value of a container label.

func GetContainerMountSource 

func GetContainerMountSource(containerRuntime, containerName, destination string) (string, error)

GetContainerMountSource returns the host source path for a given container mount destination.

func GetContainerWorkingDir 

func GetContainerWorkingDir(containerRuntime, containerName string) (string, error)

GetContainerWorkingDir returns the configured working directory for a container.

func GetImageID 

func GetImageID(containerRuntime, imageName string) (string, error)

GetImageID returns the ID of an image by name

func GetMsbDaemonProjectDir 

func GetMsbDaemonProjectDir(ctx context.Context) string

GetMsbDaemonProjectDir returns the mounted project dir of the running msb daemon.

func GetMsbWorkspaceMountDest 

func GetMsbWorkspaceMountDest(projectDir string) string

GetMsbWorkspaceMountDest returns the guest mount destination for a project dir (/workspaces/<name>).

func GetPlatformRunFlags 

func GetPlatformRunFlags() []string

GetPlatformRunFlags returns platform-specific flags for the 'run' command

func GetProjectMountPath 

func GetProjectMountPath() string

GetProjectMountPath returns the dynamic mount path for the current project

func InstallAgentsAfterBuild 

func InstallAgentsAfterBuild(cfg *config.Config) error

InstallAgentsAfterBuild runs the container once to install agents

func IsContainerRunning 

func IsContainerRunning(containerRuntime, containerName string) bool

IsContainerRunning checks if a container is currently running

func IsContainerStale 

func IsContainerStale(containerRuntime, containerName, imageName string) bool

IsContainerStale checks if a container is running an outdated image

func IsOrbStackRunning 

func IsOrbStackRunning() bool

IsOrbStackRunning checks if OrbStack is currently running on macOS

func IsRuntimeRunning 

func IsRuntimeRunning(runtimeName string) bool

IsRuntimeRunning reports whether the runtime is available and responsive.

func IsSELinuxEnabled 

func IsSELinuxEnabled() bool

IsSELinuxEnabled checks if SELinux is enabled on the system

func ListContainersByPrefix 

func ListContainersByPrefix(containerRuntime, prefix string) []string

ListContainersByPrefix returns container names matching a name prefix across all states (running, exited, etc.). Used for cleanup of CWD-derived containers where the exact name is not known at compile time.

func MapDaemonWorkdir 

func MapDaemonWorkdir(cwd, mountSource, mountDest string) (string, bool)

MapDaemonWorkdir maps a host CWD to a container workdir using the mount source/dest pair.

func MapDaemonWorkdirFromMounts 

func MapDaemonWorkdirFromMounts(cwd string, mounts []DaemonMount) (string, bool)

MapDaemonWorkdirFromMounts maps the host cwd into a daemon workdir using multi-path mounts.

func MsbInstallAgents 

func MsbInstallAgents(ctx context.Context, cfg *config.Config) error

MsbInstallAgents runs the one-shot first-run agent install inside a sandbox (msb analog of InstallAgentsAfterBuild): boot with the default entrypoint and a trivial command, wait for it to exit, verify exit code. The entrypoint performs the actual install (marker-gated, entrypoint.sh). The generated install script is (re)written into the mounted home first — PrepareBackendAgnostic owns this on the normal path; MsbInstallAgents regenerates it so a stale/empty script cannot silently skip the install.

func Prepare 

func Prepare(cfg *config.Config, containerRuntime string, configPath string) error

Prepare ensures the runtime environment is ready - Creates custom network for strict mode if needed - Generates docker-compose override for OS-specific settings and network isolation Prepare runs the full setup for the Docker/container backend: the backend-agnostic half plus the Docker-specific half (config perms, custom network, compose override). Fails closed on non-Docker backends (§4.3): every container-touching entry path funnels through here.

func PrepareBackendAgnostic 

func PrepareBackendAgnostic(cfg *config.Config, configPath string) error

PrepareBackendAgnostic holds the backend-independent setup half: mounted helper templates, the user-packages install script, and the topgrade config. Every backend (Docker, msb) runs this unchanged.

func PrepareDockerSpecific 

func PrepareDockerSpecific(cfg *config.Config, containerRuntime string, configPath string) error

PrepareDockerSpecific holds the Docker/container-only setup half: config directory permissions (Linux/WSL bind-mount ownership), the strict-mode custom network, and the docker-compose override generation.

func ResolveExecUser 

func ResolveExecUser(cfg *config.Config, containerRuntime string) string

ResolveExecUser returns the user (and optional group) to exec as inside a running container. Containers run as root (USER construct is commented out in the Dockerfile for entrypoint permission-fixing); without an explicit user, docker exec inherits root, which makes agents like Claude reject flags such as --dangerously-skip-permissions. So we default to "construct" everywhere except the one case where mapping to the host user is wanted and safe.

Only the "docker" runtime path remaps the UID; the "container" alias routes to the docker binary but does not need remapping. On Linux with ExecAsHostUser enabled, no userns-remap, and a non-root host, it returns "hostUID:hostGID" so the process owns the bind-mounted files.

func ResolveExecUserMsb 

func ResolveExecUserMsb(_ *config.Config) string

ResolveExecUserMsb resolves the exec user inside the msb guest sandbox. The entrypoint aligns the guest construct user with CONSTRUCT_HOST_UID:GID, so commands always execute as "construct" with matching numeric host ownership.

func StartContainer 

func StartContainer(containerRuntime, containerName string) error

StartContainer starts a stopped container

func StopContainer 

func StopContainer(containerRuntime, containerName string) error

StopContainer stops a running container

func UsesUserNamespaceRemap 

func UsesUserNamespaceRemap(containerRuntime string) bool

UsesUserNamespaceRemap reports whether the selected runtime remaps container UIDs to a non-host UID/GID range.

func ValidateBackendSelected 

func ValidateBackendSelected(cfg *config.Config) error

ValidateBackendSelected reports whether the compose-based run path can serve the configured backend. Entry points call this before any container operation: backend = "microvm" must fail closed with a clear message on compose-only commands, never silently fall through to Docker.

Types

type Backend 

type Backend interface {
	// Name returns the backend identifier ("docker", "microvm").
	Name() string

	// Available reports whether the backend is installed and running.
	Available(ctx context.Context) (bool, error)

	// EnsureImage guarantees the construct image exists locally
	// (build, pull, or load).
	EnsureImage(cfg *config.Config) error

	// Exec runs a command in a live environment and returns combined
	// output plus the workload exit code.
	Exec(ctx context.Context, opts ExecOptions) (string, int, error)

	// ExecStream runs a command with streamed stdio (non-interactive)
	// and returns the workload exit code.
	ExecStream(ctx context.Context, opts ExecOptions) (int, error)

	// ExecInteractive runs a command with full interactive stdio (TTY when
	// the host stdin is a terminal) and returns the workload exit code.
	// This is the path interactive agents run on.
	ExecInteractive(ctx context.Context, opts ExecOptions) (int, error)

	// State reports the lifecycle state of the named environment.
	State(ctx context.Context, name string) (ContainerState, error)

	// WorkingDir inspects the environment's default working directory.
	WorkingDir(ctx context.Context, name string) (string, error)

	// MountSource resolves the host-side source path for a mounted
	// destination inside the environment.
	MountSource(ctx context.Context, name, destination string) (string, error)

	// Label reads a label from the environment.
	Label(ctx context.Context, name, key string) (string, error)

	// ListByPrefix lists environment names matching a prefix.
	ListByPrefix(ctx context.Context, prefix string) []string

	// IsStale reports whether the environment's image differs from the
	// current local image (recreate needed).
	IsStale(ctx context.Context, name, imageName string) bool

	// Stop terminates a running environment.
	Stop(ctx context.Context, name string) error

	// Cleanup removes a non-running environment so it can be recreated.
	Cleanup(ctx context.Context, name string) error

	// CheckImageCommand returns the backend command that verifies the
	// image exists locally (used by doctor / staleness probes).
	CheckImageCommand() []string
}

Backend launches and manages the construct isolation environment. Implementations must surface workload exit codes on every exec/run path (126/127 PATH fidelity included); callers rely on them (engine.go exit hint paths).

func DetectBackend 

func DetectBackend(cfg *config.Config) (Backend, error)

DetectBackend resolves the configured isolation backend, fail closed: backend = "microvm" with msb missing is a hard error with install instructions, never a silent Docker fallback.

type ContainerState 

type ContainerState string

ContainerState represents the state of a container. 

const (
	ContainerStateRunning ContainerState = "running"
	ContainerStateExited  ContainerState = "exited"
	ContainerStateMissing ContainerState = "missing"
)

ContainerState values.

func GetContainerState 

func GetContainerState(containerRuntime, containerName string) ContainerState

GetContainerState checks the state of a container.

type DaemonMount 

type DaemonMount struct {
	HostPath      string
	ContainerPath string
}

DaemonMount defines a host-to-container mount mapping.

type DaemonMounts 

type DaemonMounts struct {
	Enabled  bool
	Paths    []string
	Mounts   []DaemonMount
	Hash     string
	Warnings []string
}

DaemonMounts holds validated multi-path daemon mount configuration.

func ResolveDaemonMounts 

func ResolveDaemonMounts(cfg *config.Config) DaemonMounts

ResolveDaemonMounts validates and normalizes multi-path daemon mount settings. It returns warnings that callers can surface to users.

type DockerBackend 

type DockerBackend struct {
	// contains filtered or unexported fields
}

DockerBackend is the reference Backend implementation. It shells out to docker/podman via the package primitives; rt selects the binary ("docker", "container", "podman").

func NewDockerBackend 

func NewDockerBackend(rt string) (*DockerBackend, error)

NewDockerBackend returns a Backend over the given container runtime.

func (*DockerBackend) Available 

func (d *DockerBackend) Available(_ context.Context) (bool, error)

Available reports whether the container runtime is running.

func (*DockerBackend) CheckImageCommand 

func (d *DockerBackend) CheckImageCommand() []string

CheckImageCommand returns the command verifying the local image exists.

func (*DockerBackend) Cleanup 

func (d *DockerBackend) Cleanup(_ context.Context, name string) error

Cleanup removes a non-running container.

func (*DockerBackend) EnsureImage 

func (d *DockerBackend) EnsureImage(cfg *config.Config) error

EnsureImage delegates to BuildImage, which reports build failure itself (existing behavior; it does not return a status). The msb backend must return a real error here instead. EnsureImage delegates to BuildImage for the construct image.

func (*DockerBackend) Exec 

func (d *DockerBackend) Exec(_ context.Context, opts ExecOptions) (string, int, error)

Exec runs a command in a live container. Exit-code fidelity: docker exec failures (including 126/127) surface through the error string from ExecInContainerWithEnv; code is 0 on success, 1 on error, matching the current callers' handling of the underlying function. Exec runs a command in a live container and returns combined output plus exit code.

func (*DockerBackend) ExecInteractive 

func (d *DockerBackend) ExecInteractive(_ context.Context, opts ExecOptions) (int, error)

ExecInteractive runs a command with interactive stdio (-i, plus -t when host stdin is a terminal) and returns the exit code.

func (*DockerBackend) ExecStream 

func (d *DockerBackend) ExecStream(_ context.Context, opts ExecOptions) (int, error)

ExecStream runs a command with streamed stdio and returns the exit code.

func (*DockerBackend) IsStale 

func (d *DockerBackend) IsStale(_ context.Context, name, imageName string) bool

IsStale reports whether the container image differs from the current local image.

func (*DockerBackend) Label 

func (d *DockerBackend) Label(_ context.Context, name, key string) (string, error)

Label reads a label from the container.

func (*DockerBackend) ListByPrefix 

func (d *DockerBackend) ListByPrefix(_ context.Context, prefix string) []string

ListByPrefix lists container names matching a prefix.

func (*DockerBackend) MountSource 

func (d *DockerBackend) MountSource(_ context.Context, name, destination string) (string, error)

MountSource resolves the host-side source path of a mounted destination.

func (*DockerBackend) Name 

func (d *DockerBackend) Name() string

Name returns the container runtime binary name this backend drives.

func (*DockerBackend) State 

func (d *DockerBackend) State(_ context.Context, name string) (ContainerState, error)

State reports the lifecycle state of the named container.

func (*DockerBackend) Stop 

func (d *DockerBackend) Stop(_ context.Context, name string) error

Stop terminates a running container.

func (*DockerBackend) WorkingDir 

func (d *DockerBackend) WorkingDir(_ context.Context, name string) (string, error)

WorkingDir inspects the container default working directory.

type ExecOptions 

type ExecOptions struct {
	Name    string   // environment name (CwdContainerName-derived)
	Command []string // argv
	Env     []string // ordered; callers may mutate in place (engine.go masking)
	Workdir string
	User    string // empty = backend default
}

ExecOptions carries the backend-agnostic exec parameters.

type MsbBackend 

type MsbBackend struct{}

MsbBackend implements Backend over microsandbox microVMs (opt-in, experimental; docs/VMs.md). Sandboxes are managed through the msb Go SDK; image transition reuses the Docker image via save+load.

func NewMsbBackend 

func NewMsbBackend() *MsbBackend

NewMsbBackend returns the microsandbox Backend.

func (*MsbBackend) Available 

func (m *MsbBackend) Available(_ context.Context) (bool, error)

Available reports whether the msb runtime is installed.

func (*MsbBackend) CheckImageCommand 

func (m *MsbBackend) CheckImageCommand() []string

CheckImageCommand returns the msb command verifying the local image.

func (*MsbBackend) Cleanup 

func (m *MsbBackend) Cleanup(ctx context.Context, name string) error

Cleanup removes the sandbox so it can be recreated: stop first if still running, wait for the stop to land, then remove.

func (*MsbBackend) EnsureImage 

func (m *MsbBackend) EnsureImage(cfg *config.Config) error

EnsureImage transitions the construct image into msb: probes local msb image first, attempts pulling from ghcr.io/estebanforge/construct-box:latest, and falls back to docker save to a temp archive + msb load.

func (*MsbBackend) Exec 

func (m *MsbBackend) Exec(ctx context.Context, opts ExecOptions) (string, int, error)

Exec runs a command inside a running sandbox. Exit-code fidelity: the SDK returns non-zero exit codes in ExecOutput, not as errors.

func (*MsbBackend) ExecInteractive 

func (m *MsbBackend) ExecInteractive(ctx context.Context, opts ExecOptions) (int, error)

ExecInteractive runs a command with full interactive stdio: host stdin is piped to the guest, a TTY is allocated when stdin is a terminal (raw mode + SIGWINCH resize forwarding), and output streams live. This is the msb analog of docker exec -it and the path interactive agents run on.

func (*MsbBackend) ExecStream 

func (m *MsbBackend) ExecStream(ctx context.Context, opts ExecOptions) (int, error)

ExecStream runs a command with streamed stdio (non-interactive): stdout and stderr stream to the host streams, no stdin attached. Exit-code fidelity: non-zero exits arrive as ExecEventExited, not errors.

func (*MsbBackend) IsStale 

func (m *MsbBackend) IsStale(_ context.Context, _, _ string) bool

IsStale is unsupported until image-ID comparison lands (Step 6 image path).

func (*MsbBackend) Label 

func (m *MsbBackend) Label(_ context.Context, _, _ string) (string, error)

Label is unsupported; msb volumes carry labels, sandboxes do not yet.

func (*MsbBackend) ListByPrefix 

func (m *MsbBackend) ListByPrefix(ctx context.Context, prefix string) []string

ListByPrefix lists sandbox names matching a prefix.

func (*MsbBackend) MountSource 

func (m *MsbBackend) MountSource(_ context.Context, _, _ string) (string, error)

MountSource is unsupported until PathMap translation lands (Step 7).

func (*MsbBackend) Name 

func (m *MsbBackend) Name() string

Name returns the backend identifier.

func (*MsbBackend) State 

func (m *MsbBackend) State(ctx context.Context, name string) (ContainerState, error)

State reports the sandbox lifecycle state mapped onto ContainerState.

func (*MsbBackend) Stop 

func (m *MsbBackend) Stop(ctx context.Context, name string) error

Stop requests a graceful sandbox stop.

func (*MsbBackend) WorkingDir 

func (m *MsbBackend) WorkingDir(_ context.Context, _ string) (string, error)

WorkingDir is unsupported until sandbox inspect parity lands (Step 7).

type MsbPathMap 

type MsbPathMap struct {
	Guest string
	Host  string
}

MsbPathMap pairs a guest mount point with its host source (used by the host exec bridge to translate a guest cwd to the host working dir).

func MsbPathMaps 

func MsbPathMaps(projectDir string) []MsbPathMap

MsbPathMaps returns the guest→host path translations for every bind in msbSandboxMounts (home, workspace, auto-mounts). Derived from the same sources so the host exec bridge can never drift from actual mounts. Maps are sorted longest guest-path first to resolve nested paths correctly.

type MsbRunSpec 

type MsbRunSpec struct {
	Name         string
	Image        string
	Mounts       map[string]msb.MountConfig
	Network      *msb.NetworkConfig
	Env          map[string]string
	HostAliasEnv string   // CONSTRUCT_HOST_ALIAS value for the entrypoint
	Entrypoint   []string // empty = image entrypoint; override for one-shot flows (update-all, install, sha256 verify)
	Cmd          []string // workload; empty = sleep infinity (persistent sandbox)
	PortBindings []msb.PortBinding
	Labels       map[string]string
	Detached     bool   // VM outlives the creating process (daemon sandboxes)
	CPUs         uint8  // 0 = msb default (1)
	MemoryMiB    uint32 // 0 = msb default (512)
}

MsbRunSpec is the sandbox-creation input assembled from config; the engine-side port (Step 6 wiring) consumes it.

func BuildMsbRunSpec 

func BuildMsbRunSpec(cfg *config.Config, name, projectDir string, bridgePorts []int) *MsbRunSpec

BuildMsbRunSpec assembles the sandbox spec from config and project dir. Pure function: no side effects, unit-testable without msb installed.

type WorkspacePolicy 

type WorkspacePolicy struct {
	AllowHome   bool
	Interactive bool
	Confirm     func(prompt string) bool
}

WorkspacePolicy specifies how workspace risks should be enforced.

type WorkspaceRisk 

type WorkspaceRisk int

WorkspaceRisk represents the assessed risk level of mounting a directory into a microVM. 

const (
	// WorkspaceRiskOK indicates a safe workspace directory.
	WorkspaceRiskOK WorkspaceRisk = iota
	// WorkspaceRiskLarge indicates the directory exceeds the entry budget.
	WorkspaceRiskLarge
	// WorkspaceRiskHome indicates the directory is the host user home directory.
	WorkspaceRiskHome
	// WorkspaceRiskSystem indicates the directory is a system root.
	WorkspaceRiskSystem
)

Workspace risk levels.

type WorkspaceVerdict 

type WorkspaceVerdict struct {
	Path     string
	Risk     WorkspaceRisk
	Reason   string
	Entries  int      // Counted before budget exhaustion
	Capped   bool     // True when entry budget was reached
	TimedOut bool     // True when scan duration limit was reached
	Hot      []string // High-risk subdirectories found at top level
}

WorkspaceVerdict holds the outcome of evaluating a candidate workspace path.

func EvaluateWorkspace 

func EvaluateWorkspace(dir string, budget int) WorkspaceVerdict

EvaluateWorkspace inspects a candidate workspace directory before mounting.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.