sandbox

Documentation

Overview

Package sandbox configures platform-specific execution constraints.

Index

• func BuildShellCommand(strategy, workspace, command string) (string, []string, error)
• func BuildShellCommandWithStatus(strategy, workspace, command string, status SandboxExecutionStatus) (string, []string, error)
• func BuildWindowsRestrictedTokenCommand(workspace, command, shell string) (string, []string, error)
• func ResolveStrategy(strategy string) (string, error)
• func ShellCommand(strategy, workspace, command string) (string, []string, string, error)
• func ValidateStrategyName(strategy string) error
• type CapabilityGap
• type ContainerStatus
• type DetectionInputs
• type FilesystemIsolationMode
  • func ParseFilesystemIsolationMode(value string) (FilesystemIsolationMode, error)
• type SandboxExecutionStatus
  • func ResolveSandboxExecutionStatus(strategy, workspace string, opts SandboxRequestOptions) (SandboxExecutionStatus, string, error)
  • func ResolveSandboxExecutionStatusFor(strategy, workspace string, opts SandboxRequestOptions, detected Status) (SandboxExecutionStatus, string, error)
  • func ShellCommandWithSandboxStatus(strategy, workspace, command string, opts SandboxRequestOptions) (string, []string, string, SandboxExecutionStatus, error)
• type SandboxRequest
  • func DefaultSandboxRequest(strategy string) SandboxRequest
  • func ResolveSandboxRequest(strategy string, opts SandboxRequestOptions) SandboxRequest
• type SandboxRequestOptions
• type Status
  • func Detect() Status
  • func DetectFor(inputs DetectionInputs) Status
• type StrategyResolution
  • func ResolveStrategyReport(strategy string) StrategyResolution
  • func ResolveStrategyReportFor(strategy string, status Status) StrategyResolution
• type StrategyStatus

Functions

func BuildShellCommand

func BuildShellCommand(strategy, workspace, command string) (string, []string, error)

func BuildShellCommandWithStatus

func BuildShellCommandWithStatus(strategy, workspace, command string, status SandboxExecutionStatus) (string, []string, error)

func BuildWindowsRestrictedTokenCommand

func BuildWindowsRestrictedTokenCommand(workspace, command, shell string) (string, []string, error)

func ResolveStrategy

func ResolveStrategy(strategy string) (string, error)

func ShellCommand

func ShellCommand(strategy, workspace, command string) (string, []string, string, error)

func ValidateStrategyName

func ValidateStrategyName(strategy string) error

ValidateStrategyName reports whether strategy names a supported sandbox strategy.

Types

type CapabilityGap

type CapabilityGap struct {
	Capability string `json:"capability"`
	Requested  bool   `json:"requested"`
	Supported  bool   `json:"supported"`
	Active     bool   `json:"active"`
	Reason     string `json:"reason"`
}

type ContainerStatus

type ContainerStatus struct {
	InContainer bool     `json:"in_container"`
	Markers     []string `json:"markers,omitempty"`
}

type DetectionInputs

type DetectionInputs struct {
	OS                 string
	Env                []string
	DockerEnvExists    bool
	ContainerEnvExists bool
	Proc1Cgroup        string
	CommandAvailable   func(string) bool
	UserNamespaceWorks func() bool
}

type FilesystemIsolationMode

type FilesystemIsolationMode string

const (
	FilesystemIsolationOff           FilesystemIsolationMode = "off"
	FilesystemIsolationWorkspaceOnly FilesystemIsolationMode = "workspace-only"
	FilesystemIsolationAllowList     FilesystemIsolationMode = "allow-list"
)

func ParseFilesystemIsolationMode

func ParseFilesystemIsolationMode(value string) (FilesystemIsolationMode, error)

type SandboxExecutionStatus

type SandboxExecutionStatus struct {
	Enabled               bool            `json:"enabled"`
	Requested             SandboxRequest  `json:"requested"`
	Supported             bool            `json:"supported"`
	Active                bool            `json:"active"`
	Strategy              string          `json:"strategy,omitempty"`
	NamespaceSupported    bool            `json:"namespace_supported"`
	NamespaceActive       bool            `json:"namespace_active"`
	NetworkSupported      bool            `json:"network_supported"`
	NetworkActive         bool            `json:"network_active"`
	FilesystemMode        string          `json:"filesystem_mode"`
	FilesystemActive      bool            `json:"filesystem_active"`
	AllowedMounts         []string        `json:"allowed_mounts"`
	InContainer           bool            `json:"in_container"`
	ContainerMarkers      []string        `json:"container_markers,omitempty"`
	FallbackReason        string          `json:"fallback_reason,omitempty"`
	CapabilityGaps        []CapabilityGap `json:"capability_gaps,omitempty"`
	ConfiguredStrategy    string          `json:"configured_strategy,omitempty"`
	ResolutionStatus      string          `json:"resolution_status,omitempty"`
	ResolutionAvailable   bool            `json:"resolution_available"`
	InternalWritablePaths []string        `json:"-"`
}

func ResolveSandboxExecutionStatus

func ResolveSandboxExecutionStatus(strategy, workspace string, opts SandboxRequestOptions) (SandboxExecutionStatus, string, error)

func ResolveSandboxExecutionStatusFor

func ResolveSandboxExecutionStatusFor(strategy, workspace string, opts SandboxRequestOptions, detected Status) (SandboxExecutionStatus, string, error)

func ShellCommandWithSandboxStatus

func ShellCommandWithSandboxStatus(strategy, workspace, command string, opts SandboxRequestOptions) (string, []string, string, SandboxExecutionStatus, error)

type SandboxRequest

type SandboxRequest struct {
	Enabled               bool                    `json:"enabled"`
	NamespaceRestrictions bool                    `json:"namespace_restrictions"`
	NetworkIsolation      bool                    `json:"network_isolation"`
	FilesystemMode        FilesystemIsolationMode `json:"filesystem_mode"`
	AllowedMounts         []string                `json:"allowed_mounts"`
}

func DefaultSandboxRequest

func DefaultSandboxRequest(strategy string) SandboxRequest

func ResolveSandboxRequest

func ResolveSandboxRequest(strategy string, opts SandboxRequestOptions) SandboxRequest

type SandboxRequestOptions

type SandboxRequestOptions struct {
	Enabled               *bool
	NamespaceRestrictions *bool
	NetworkIsolation      *bool
	FilesystemMode        FilesystemIsolationMode
	AllowedMounts         []string
	InternalWritablePaths []string
}

type Status

type Status struct {
	OS                 string           `json:"os"`
	Strategies         []string         `json:"strategies"`
	Default            string           `json:"default"`
	Available          bool             `json:"available"`
	StrategyStatuses   []StrategyStatus `json:"strategy_statuses,omitempty"`
	Container          ContainerStatus  `json:"container"`
	NamespaceSupported bool             `json:"namespace_supported"`
	NetworkSupported   bool             `json:"network_supported"`
	FallbackReason     string           `json:"fallback_reason,omitempty"`
}

func Detect

func Detect() Status

func DetectFor

func DetectFor(inputs DetectionInputs) Status

type StrategyResolution

type StrategyResolution struct {
	Configured     string `json:"configured"`
	Effective      string `json:"effective,omitempty"`
	Enabled        bool   `json:"enabled"`
	Available      bool   `json:"available"`
	Status         string `json:"status"`
	FallbackReason string `json:"fallback_reason,omitempty"`
	Error          string `json:"error,omitempty"`
}

func ResolveStrategyReport

func ResolveStrategyReport(strategy string) StrategyResolution

func ResolveStrategyReportFor

func ResolveStrategyReportFor(strategy string, status Status) StrategyResolution

type StrategyStatus

type StrategyStatus struct {
	Name      string `json:"name"`
	Available bool   `json:"available"`
	Reason    string `json:"reason,omitempty"`
}