Directories
¶
| Path | Synopsis |
|---|---|
|
Package admission holds the controller's validating admission webhooks.
|
Package admission holds the controller's validating admission webhooks. |
|
Package agentcli implements the Mitos command-line interface: a thin, dependency-free command tree over a Backend that drives the sandbox lifecycle (create, exec, file IO, fork, terminate, list).
|
Package agentcli implements the Mitos command-line interface: a thin, dependency-free command tree over a Backend that drives the sandbox lifecycle (create, exec, file IO, fork, terminate, list). |
|
Package apierr defines the LLM-legible error envelope returned by the forkd sandbox API and the standalone sandbox-server.
|
Package apierr defines the LLM-legible error envelope returned by the forkd sandbox API and the standalone sandbox-server. |
|
Package atr is a native Go evaluator for the regex-condition subset of Agent Threat Rules (ATR-SPEC-v1, https://github.com/Agent-Threat-Rule/agent-threat-rules), an MIT-licensed Sigma-style ruleset for AI-agent threats.
|
Package atr is a native Go evaluator for the regex-condition subset of Agent Threat Rules (ATR-SPEC-v1, https://github.com/Agent-Threat-Rule/agent-threat-rules), an MIT-licensed Sigma-style ruleset for AI-agent threats. |
|
Package benchstat provides pure latency statistics for the bench driver: nearest-rank percentile summarization, a human-readable table, and a JSON-serializable result view.
|
Package benchstat provides pure latency statistics for the bench driver: nearest-rank percentile summarization, a human-readable table, and a JSON-serializable result view. |
|
Package captoken implements macaroon-style attenuated capability tokens for per-sandbox runtime authorization (issue #25, docs/api/v2-spec.md section 3, design in docs/api/capability-budgets.md).
|
Package captoken implements macaroon-style attenuated capability tokens for per-sandbox runtime authorization (issue #25, docs/api/v2-spec.md section 3, design in docs/api/capability-budgets.md). |
|
Package cas implements a content-addressed store for VM memory and disk snapshots.
|
Package cas implements a content-addressed store for VM memory and disk snapshots. |
|
Package casgc drives the content-addressed store's eviction (cas.EvictToFit) so orphaned chunks do not grow unbounded and trip node DiskPressure (#464).
|
Package casgc drives the content-addressed store's eviction (cas.EvictToFit) so orphaned chunks do not grow unbounded and trip node DiskPressure (#464). |
|
cli
|
|
|
sandboxtable
Package sandboxtable renders Sandbox and SandboxPool lists as aligned kubectl-style tables.
|
Package sandboxtable renders Sandbox and SandboxPool lists as aligned kubectl-style tables. |
|
Package compose defines the Harbor compose provider contract for a mitos sandbox (issue #491, part of the compose epic #487).
|
Package compose defines the Harbor compose provider contract for a mitos sandbox (issue #491, part of the compose epic #487). |
|
Package cpupin computes dynamic (post-ready) CPU pin plans for sandbox VMs (issue #168).
|
Package cpupin computes dynamic (post-ready) CPU pin plans for sandbox VMs (issue #168). |
|
Package credfile reads the bearer token from the CLI login profile written by `mitos auth login`, so the agent-facing surfaces (mcp server, and any other Go consumer) pick up one login without a separate env var.
|
Package credfile reads the bearer token from the CLI login profile written by `mitos auth login`, so the agent-facing surfaces (mcp server, and any other Go consumer) pick up one login without a separate env var. |
|
internal/daemon/expose.go
|
internal/daemon/expose.go |
|
Package deviceplugin implements a Kubernetes device plugin that advertises the KVM device (mitos.run/kvm) to the kubelet and injects /dev/kvm (and /dev/net/tun) into containers that request it.
|
Package deviceplugin implements a Kubernetes device plugin that advertises the KVM device (mitos.run/kvm) to the kubelet and injects /dev/kvm (and /dev/net/tun) into containers that request it. |
|
Package dnsproxy implements a controlled DNS resolver for sandbox egress.
|
Package dnsproxy implements a controlled DNS resolver for sandbox egress. |
|
Package egressproxy implements a host-side HTTP forward proxy for sandboxed guests.
|
Package egressproxy implements a host-side HTTP forward proxy for sandboxed guests. |
|
Package eventfeed builds the workspace revision change feed: CloudEvents 1.0 envelopes describing workspace and sandbox lifecycle events, delivered to an opt-in operator webhook sink and (always) mirrored as Kubernetes Events on the source object.
|
Package eventfeed builds the workspace revision change feed: CloudEvents 1.0 envelopes describing workspace and sandbox lifecycle events, delivered to an opt-in operator webhook sink and (always) mirrored as Kubernetes Events on the source object. |
|
Package facade implements the agents.x-k8s.io conformance facade (issue #19).
|
Package facade implements the agents.x-k8s.io conformance facade (issue #19). |
|
Package frontdoor implements the routing decision and reverse-proxy core for the Mitos front-door.
|
Package frontdoor implements the routing decision and reverse-proxy core for the Mitos front-door. |
|
Package guestenv builds the environment for guest exec sessions.
|
Package guestenv builds the environment for guest exec sessions. |
|
Package guestgrpc provides a reusable host-side gRPC client for the guest agent's gRPC services (sandbox.v1.Sandbox and sandbox.internal.v1.Control).
|
Package guestgrpc provides a reusable host-side gRPC client for the guest agent's gRPC services (sandbox.v1.Sandbox and sandbox.internal.v1.Control). |
|
Package guestnet configures the guest VM's single NIC after a snapshot restore using rtnetlink syscalls directly, with no dependency on an `ip` binary in the rootfs.
|
Package guestnet configures the guest VM's single NIC after a snapshot restore using rtnetlink syscalls directly, with no dependency on an `ip` binary in the rootfs. |
|
Package guestsock is the in-guest self-service protocol (issue #22, API v2 section 2.2): the small request/response shape the guest agent serves on a unix socket inside the VM (MITOS_SOCKET, default /run/mitos.sock) so the in-VM workload can self-service without any network egress and without an external orchestrator round-trip.
|
Package guestsock is the in-guest self-service protocol (issue #22, API v2 section 2.2): the small request/response shape the guest agent serves on a unix socket inside the VM (MITOS_SOCKET, default /run/mitos.sock) so the in-VM workload can self-service without any network egress and without an external orchestrator round-trip. |
|
Package guestvitals holds the platform-neutral parsers and arithmetic for the Layer 3 guest telemetry bridge (issue #164): CPU steal from /proc/stat, memory vs balloon, and the in-guest process table.
|
Package guestvitals holds the platform-neutral parsers and arithmetic for the Layer 3 guest telemetry bridge (issue #164): CPU steal from /proc/stat, memory vs balloon, and the in-guest process table. |
|
Package husk implements the husk-pod stub: a single-VM process that brings up a DORMANT Firecracker VMM at prepare time and ACTIVATES it in place by loading a snapshot when an activate request arrives over a control socket.
|
Package husk implements the husk-pod stub: a single-VM process that brings up a DORMANT Firecracker VMM at prepare time and ACTIVATES it in place by loading a snapshot when an activate request arrives over a control socket. |
|
Package huskprobe holds the pure measurement math behind the husk-probe command (cmd/husk-probe).
|
Package huskprobe holds the pure measurement math behind the husk-probe command (cmd/husk-probe). |
|
Package kms provides envelope encryption for the at-rest data-encryption key (DEK).
|
Package kms provides envelope encryption for the at-rest data-encryption key (DEK). |
|
Package mcp implements a Model Context Protocol (MCP) server that exposes the sandbox lifecycle (create, exec, file IO, fork, terminate) as MCP tools over a JSON-RPC 2.0 stdio transport.
|
Package mcp implements a Model Context Protocol (MCP) server that exposes the sandbox lifecycle (create, exec, file IO, fork, terminate) as MCP tools over a JSON-RPC 2.0 stdio transport. |
|
Package metering aggregates per-sandbox resource samples into a node report that accounts for copy-on-write (CoW) sharing across forks of the same template.
|
Package metering aggregates per-sandbox resource samples into a node report that accounts for copy-on-write (CoW) sharing across forks of the same template. |
|
Package netconf holds pure, platform-independent helpers for sandbox network configuration: per-sandbox network identity allocation, nftables ruleset rendering, and command argument builders.
|
Package netconf holds pure, platform-independent helpers for sandbox network configuration: per-sandbox network identity allocation, nftables ruleset rendering, and command argument builders. |
|
Package network applies and tears down per-sandbox host networking: a tap device, its host IP, and a per-tap nftables egress ruleset.
|
Package network applies and tears down per-sandbox host networking: a tap device, its host IP, and a per-tap nftables egress ruleset. |
|
Package observability wires OpenTelemetry tracing for the control plane.
|
Package observability wires OpenTelemetry tracing for the control plane. |
|
Package ociroot pulls OCI images and flattens them into a directory tree and an ext4 rootfs image suitable for booting inside a microVM.
|
Package ociroot pulls OCI images and flattens them into a directory tree and an ext4 rootfs image suitable for booting inside a microVM. |
|
Package pki provides the internal certificate authority for the control plane: the controller and forkd authenticate each other with mTLS using exactly two leaf identities issued by this CA.
|
Package pki provides the internal certificate authority for the control plane: the controller and forkd authenticate each other with mTLS using exactly two leaf identities issued by this CA. |
|
Package preview implements per-sandbox preview URLs: a signed, expiring URL (Daytona style) that names a sandbox and a port, plus a reverse proxy that resolves <label>.<domain> to the sandbox backend, verifies the signed token and the per-sandbox bearer gate, and proxies to the backend (issue #126).
|
Package preview implements per-sandbox preview URLs: a signed, expiring URL (Daytona style) that names a sandbox and a port, plus a reverse proxy that resolves <label>.<domain> to the sandbox backend, verifies the signed token and the per-sandbox bearer gate, and proxies to the backend (issue #126). |
|
Package rendezvous is a minimal authenticated git-http rendezvous server: the real external remote the {git} workspace output pushes per-attempt branches to.
|
Package rendezvous is a minimal authenticated git-http rendezvous server: the real external remote the {git} workspace output pushes per-attempt branches to. |
|
Package runmanifest parses and validates the mitos.yaml "Run with Mitos" manifest (schema v1) and maps it to the mitos primitives: a golden SandboxPool to fork from, plus the run, preview, secret, egress, workspace, and auto-update (track) intent the provisioner and the auto-update reconciler consume.
|
Package runmanifest parses and validates the mitos.yaml "Run with Mitos" manifest (schema v1) and maps it to the mitos primitives: a golden SandboxPool to fork from, plus the run, preview, secret, egress, workspace, and auto-update (track) intent the provisioner and the auto-update reconciler consume. |
|
Package runservice turns a "Run with Mitos" click into a provisioned instance: it fetches a repo's mitos.yaml, ensures the golden SandboxPool, provisions the per-fork Sandbox and its Secret, applies them, and returns the live URL.
|
Package runservice turns a "Run with Mitos" click into a provisioned instance: it fetches a repo's mitos.yaml, ensures the golden SandboxPool, provisions the per-fork Sandbox and its Secret, applies them, and returns the live URL. |
|
Package saas is the customer-facing front door for the hosted offering: real external accounts, organizations, memberships, and scoped API keys, layered ABOVE the internal mTLS and per-sandbox token plane (issue #210).
|
Package saas is the customer-facing front door for the hosted offering: real external accounts, organizations, memberships, and scoped API keys, layered ABOVE the internal mTLS and per-sandbox token plane (issue #210). |
|
billing
Package billing wires the money for the hosted offering (issue #212): Stripe metered usage-based billing, plans, free signup credits, prepaid top-ups, hard/soft spend caps, and dunning, layered on top of the per-org UsageRecords from issue #211 and coordinated with the kill-switch from issue #213.
|
Package billing wires the money for the hosted offering (issue #212): Stripe metered usage-based billing, plans, free signup credits, prepaid top-ups, hard/soft spend caps, and dunning, layered on top of the per-org UsageRecords from issue #211 and coordinated with the kill-switch from issue #213. |
|
billingprovider
Package billingprovider abstracts the payment backend behind a provider seam, the same way console.SecretStore abstracts the secret backend.
|
Package billingprovider abstracts the payment backend behind a provider seam, the same way console.SecretStore abstracts the secret backend. |
|
billingprovider/paddle
Package paddle is the Paddle Billing implementation of billingprovider.Provider.
|
Package paddle is the Paddle Billing implementation of billingprovider.Provider. |
|
billingprovider/stripe
Package stripe is the Stripe implementation of billingprovider.Provider.
|
Package stripe is the Stripe implementation of billingprovider.Provider. |
|
console
The instance-operator plane: GET/POST /console/admin/...
|
The instance-operator plane: GET/POST /console/admin/... |
|
console/baosecrets
Package baosecrets is the OpenBao (and Vault) SecretStore provider: the recommended external backend behind the console.SecretStore seam (spec §8).
|
Package baosecrets is the OpenBao (and Vault) SecretStore provider: the recommended external backend behind the console.SecretStore seam (spec §8). |
|
console/clusterforktree
Package clusterforktree is the real console.ForkTreeSource: it builds an org's live fork tree from the controller's v1 Sandbox records scoped to one org.
|
Package clusterforktree is the real console.ForkTreeSource: it builds an org's live fork tree from the controller's v1 Sandbox records scoped to one org. |
|
console/clusterinstruments
Package clusterinstruments is the real console.InstrumentsSource: it measures an org's proof snapshot from the controller's v1 Sandbox records scoped to one org.
|
Package clusterinstruments is the real console.InstrumentsSource: it measures an org's proof snapshot from the controller's v1 Sandbox records scoped to one org. |
|
console/clusternodes
Package clusternodes is the real console.NodeSource: a read-only inventory of the cluster's Kubernetes nodes for the instance-operator plane's GET /console/admin/nodes.
|
Package clusternodes is the real console.NodeSource: a read-only inventory of the cluster's Kubernetes nodes for the instance-operator plane's GET /console/admin/nodes. |
|
console/clustersandbox
Package clustersandbox is the real console.SandboxControl: it queries the controller's v1 Sandbox records scoped to one org, the cluster-backed implementation of the live-sandbox seam (issue #2).
|
Package clustersandbox is the real console.SandboxControl: it queries the controller's v1 Sandbox records scoped to one org, the cluster-backed implementation of the live-sandbox seam (issue #2). |
|
console/kubesecrets
Package kubesecrets is the kube SecretStore provider: it materializes org secrets as namespaced Kubernetes Secrets, the self-host default backend behind the console.SecretStore seam (spec §8).
|
Package kubesecrets is the kube SecretStore provider: it materializes org secrets as namespaced Kubernetes Secrets, the self-host default backend behind the console.SecretStore seam (spec §8). |
|
controlplane
Package controlplane is the real hosted control plane behind the public gateway (issue #210, ROADMAP SaaS P1).
|
Package controlplane is the real hosted control plane behind the public gateway (issue #210, ROADMAP SaaS P1). |
|
oidcauth
Package oidcauth wires the browser OIDC login flow for the console: it drives the authorization-code redirect, exchanges the code, and turns the verified identity into a session cookie via the saas.LoginManager.
|
Package oidcauth wires the browser OIDC login flow for the console: it drives the authorization-code redirect, exchanges the code, and turns the verified identity into a session cookie via the saas.LoginManager. |
|
onboarding
Package onboarding is the self-serve onboarding funnel for the hosted offering (issue #215): it ties together sign-up, email verification, auto-creation of a Personal organization (Daytona-style), the free-tier signup credit grant (the #212 ledger), and issuance of the first API key (#210), so a brand-new user reaches a first successful run_code in minutes with no card on the free tier and exactly one SDK package.
|
Package onboarding is the self-serve onboarding funnel for the hosted offering (issue #215): it ties together sign-up, email verification, auto-creation of a Personal organization (Daytona-style), the free-tier signup credit grant (the #212 ledger), and issuance of the first API key (#210), so a brand-new user reaches a first successful run_code in minutes with no card on the free tier and exactly one SDK package. |
|
orgprovision
Package orgprovision implements the onboarding.OrgProvisioner seam over a controller-runtime client: a verified signup creates the cluster-scoped Org custom resource (api/v1.Org, name = org id), which the OrgReconciler turns into a per-org isolation namespace (issue #288).
|
Package orgprovision implements the onboarding.OrgProvisioner seam over a controller-runtime client: a verified signup creates the cluster-scoped Org custom resource (api/v1.Org, name = org id), which the OrgReconciler turns into a per-org isolation namespace (issue #288). |
|
pgstore
Package pgstore is the durable Postgres implementation of saas.Store.
|
Package pgstore is the durable Postgres implementation of saas.Store. |
|
placement
Package placement is the Phase 0 placement registry (issue #712): the operator-defined key and value set a deployment advertises for where a resource lives.
|
Package placement is the Phase 0 placement registry (issue #712): the operator-defined key and value set a deployment advertises for where a resource lives. |
|
quota
Package quota is the abuse-control envelope for the hosted offering (issue #213): per-organization quotas, per-org and per-IP rate limiting, live concurrency and aggregate-resource caps, per-tier egress policy selection, and the kill-switch (org suspension).
|
Package quota is the abuse-control envelope for the hosted offering (issue #213): per-organization quotas, per-org and per-IP rate limiting, live concurrency and aggregate-resource caps, per-tier egress policy selection, and the kill-switch (org suspension). |
|
storetest
Package storetest holds the shared behavioral contract for saas.Store.
|
Package storetest holds the shared behavioral contract for saas.Store. |
|
Package sandboxrpc: GuestConn is the port (hexagonal architecture seam) between the Connect Sandbox service and the in-guest execution surface.
|
Package sandboxrpc: GuestConn is the port (hexagonal architecture seam) between the Connect Sandbox service and the in-guest execution surface. |
|
Package snapcompat defines the snapshot compatibility contract: whether a snapshot captured in one environment can be safely restored in another.
|
Package snapcompat defines the snapshot compatibility contract: whether a snapshot captured in one environment can be safely restored in another. |
|
Package sniproxy implements a host-side TLS SNI peek-and-splice egress filter for sandboxed guests.
|
Package sniproxy implements a host-side TLS SNI peek-and-splice egress filter for sandboxed guests. |
|
Package storecrypt manages per-scope LUKS containers that hold template snapshots encrypted at rest.
|
Package storecrypt manages per-scope LUKS containers that hold template snapshots encrypted at rest. |
|
Package telemetry is a privacy-first PRODUCT-USAGE telemetry pipeline for the hosted Mitos binaries.
|
Package telemetry is a privacy-first PRODUCT-USAGE telemetry pipeline for the hosted Mitos binaries. |
|
Package templatebuild holds the pure, host-side logic for the declarative template builder (issue #220): the content-addressed cache key chained over the base image and each build step, the skip decision that reuses an unchanged prefix, and the typed build error.
|
Package templatebuild holds the pure, host-side logic for the declarative template builder (issue #220): the content-addressed cache key chained over the base image and each build step, the skip decision that reuses an unchanged prefix, and the typed build error. |
|
Package tenant holds the canonical multi-tenancy convention shared across the SaaS surfaces: the org label stamped on tenant-owned objects and the hard per-org namespace each tenant's workloads live in.
|
Package tenant holds the canonical multi-tenancy convention shared across the SaaS surfaces: the org label stamped on tenant-owned objects and the hard per-org namespace each tenant's workloads live in. |
|
Package usage turns per-node CoW-aware operational metering (internal/metering, the forkd GET /v1/metering endpoint) into per-organization, time-integrated, auditable usage records, and serves an org-scoped public usage API on top of them (issue #211).
|
Package usage turns per-node CoW-aware operational metering (internal/metering, the forkd GET /v1/metering endpoint) into per-organization, time-integrated, auditable usage records, and serves an org-scoped public usage API on top of them (issue #211). |
|
usagestoretest
Package usagestoretest holds the shared behavioral contract for usage.UsageStore.
|
Package usagestoretest holds the shared behavioral contract for usage.UsageStore. |
|
Package volume prepares per-sandbox block-device backing files on a forkd node.
|
Package volume prepares per-sandbox block-device backing files on a forkd node. |
|
Package workspace holds the host-side hydrate/dehydrate helpers that move a sandbox's /workspace tree between a running guest and the content-addressed store (internal/cas).
|
Package workspace holds the host-side hydrate/dehydrate helpers that move a sandbox's /workspace tree between a running guest and the content-addressed store (internal/cas). |
Click to show internal directories.
Click to hide internal directories.