internal/

directory
v1.43.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 15, 2026 License: Apache-2.0

Directories

Path Synopsis
Package admission holds the controller's validating admission webhooks.
Package admission holds the controller's validating admission webhooks.
Package agentcli implements the Mitos command-line interface: a thin, dependency-free command tree over a Backend that drives the sandbox lifecycle (create, exec, file IO, fork, terminate, list).
Package agentcli implements the Mitos command-line interface: a thin, dependency-free command tree over a Backend that drives the sandbox lifecycle (create, exec, file IO, fork, terminate, list).
Package apierr defines the LLM-legible error envelope returned by the forkd sandbox API and the standalone sandbox-server.
Package apierr defines the LLM-legible error envelope returned by the forkd sandbox API and the standalone sandbox-server.
Package atr is a native Go evaluator for the regex-condition subset of Agent Threat Rules (ATR-SPEC-v1, https://github.com/Agent-Threat-Rule/agent-threat-rules), an MIT-licensed Sigma-style ruleset for AI-agent threats.
Package atr is a native Go evaluator for the regex-condition subset of Agent Threat Rules (ATR-SPEC-v1, https://github.com/Agent-Threat-Rule/agent-threat-rules), an MIT-licensed Sigma-style ruleset for AI-agent threats.
Package benchstat provides pure latency statistics for the bench driver: nearest-rank percentile summarization, a human-readable table, and a JSON-serializable result view.
Package benchstat provides pure latency statistics for the bench driver: nearest-rank percentile summarization, a human-readable table, and a JSON-serializable result view.
Package captoken implements macaroon-style attenuated capability tokens for per-sandbox runtime authorization (issue #25, docs/api/v2-spec.md section 3, design in docs/api/capability-budgets.md).
Package captoken implements macaroon-style attenuated capability tokens for per-sandbox runtime authorization (issue #25, docs/api/v2-spec.md section 3, design in docs/api/capability-budgets.md).
Package cas implements a content-addressed store for VM memory and disk snapshots.
Package cas implements a content-addressed store for VM memory and disk snapshots.
Package casgc drives the content-addressed store's eviction (cas.EvictToFit) so orphaned chunks do not grow unbounded and trip node DiskPressure (#464).
Package casgc drives the content-addressed store's eviction (cas.EvictToFit) so orphaned chunks do not grow unbounded and trip node DiskPressure (#464).
cli
sandboxtable
Package sandboxtable renders Sandbox and SandboxPool lists as aligned kubectl-style tables.
Package sandboxtable renders Sandbox and SandboxPool lists as aligned kubectl-style tables.
Package compose defines the Harbor compose provider contract for a mitos sandbox (issue #491, part of the compose epic #487).
Package compose defines the Harbor compose provider contract for a mitos sandbox (issue #491, part of the compose epic #487).
Package cpupin computes dynamic (post-ready) CPU pin plans for sandbox VMs (issue #168).
Package cpupin computes dynamic (post-ready) CPU pin plans for sandbox VMs (issue #168).
Package credfile reads the bearer token from the CLI login profile written by `mitos auth login`, so the agent-facing surfaces (mcp server, and any other Go consumer) pick up one login without a separate env var.
Package credfile reads the bearer token from the CLI login profile written by `mitos auth login`, so the agent-facing surfaces (mcp server, and any other Go consumer) pick up one login without a separate env var.
internal/daemon/expose.go
internal/daemon/expose.go
Package deviceplugin implements a Kubernetes device plugin that advertises the KVM device (mitos.run/kvm) to the kubelet and injects /dev/kvm (and /dev/net/tun) into containers that request it.
Package deviceplugin implements a Kubernetes device plugin that advertises the KVM device (mitos.run/kvm) to the kubelet and injects /dev/kvm (and /dev/net/tun) into containers that request it.
Package dnsproxy implements a controlled DNS resolver for sandbox egress.
Package dnsproxy implements a controlled DNS resolver for sandbox egress.
Package egressproxy implements a host-side HTTP forward proxy for sandboxed guests.
Package egressproxy implements a host-side HTTP forward proxy for sandboxed guests.
Package eventfeed builds the workspace revision change feed: CloudEvents 1.0 envelopes describing workspace and sandbox lifecycle events, delivered to an opt-in operator webhook sink and (always) mirrored as Kubernetes Events on the source object.
Package eventfeed builds the workspace revision change feed: CloudEvents 1.0 envelopes describing workspace and sandbox lifecycle events, delivered to an opt-in operator webhook sink and (always) mirrored as Kubernetes Events on the source object.
Package facade implements the agents.x-k8s.io conformance facade (issue #19).
Package facade implements the agents.x-k8s.io conformance facade (issue #19).
Package frontdoor implements the routing decision and reverse-proxy core for the Mitos front-door.
Package frontdoor implements the routing decision and reverse-proxy core for the Mitos front-door.
Package guestenv builds the environment for guest exec sessions.
Package guestenv builds the environment for guest exec sessions.
Package guestgrpc provides a reusable host-side gRPC client for the guest agent's gRPC services (sandbox.v1.Sandbox and sandbox.internal.v1.Control).
Package guestgrpc provides a reusable host-side gRPC client for the guest agent's gRPC services (sandbox.v1.Sandbox and sandbox.internal.v1.Control).
Package guestnet configures the guest VM's single NIC after a snapshot restore using rtnetlink syscalls directly, with no dependency on an `ip` binary in the rootfs.
Package guestnet configures the guest VM's single NIC after a snapshot restore using rtnetlink syscalls directly, with no dependency on an `ip` binary in the rootfs.
Package guestsock is the in-guest self-service protocol (issue #22, API v2 section 2.2): the small request/response shape the guest agent serves on a unix socket inside the VM (MITOS_SOCKET, default /run/mitos.sock) so the in-VM workload can self-service without any network egress and without an external orchestrator round-trip.
Package guestsock is the in-guest self-service protocol (issue #22, API v2 section 2.2): the small request/response shape the guest agent serves on a unix socket inside the VM (MITOS_SOCKET, default /run/mitos.sock) so the in-VM workload can self-service without any network egress and without an external orchestrator round-trip.
Package guestvitals holds the platform-neutral parsers and arithmetic for the Layer 3 guest telemetry bridge (issue #164): CPU steal from /proc/stat, memory vs balloon, and the in-guest process table.
Package guestvitals holds the platform-neutral parsers and arithmetic for the Layer 3 guest telemetry bridge (issue #164): CPU steal from /proc/stat, memory vs balloon, and the in-guest process table.
Package husk implements the husk-pod stub: a single-VM process that brings up a DORMANT Firecracker VMM at prepare time and ACTIVATES it in place by loading a snapshot when an activate request arrives over a control socket.
Package husk implements the husk-pod stub: a single-VM process that brings up a DORMANT Firecracker VMM at prepare time and ACTIVATES it in place by loading a snapshot when an activate request arrives over a control socket.
Package huskprobe holds the pure measurement math behind the husk-probe command (cmd/husk-probe).
Package huskprobe holds the pure measurement math behind the husk-probe command (cmd/husk-probe).
Package kms provides envelope encryption for the at-rest data-encryption key (DEK).
Package kms provides envelope encryption for the at-rest data-encryption key (DEK).
Package mcp implements a Model Context Protocol (MCP) server that exposes the sandbox lifecycle (create, exec, file IO, fork, terminate) as MCP tools over a JSON-RPC 2.0 stdio transport.
Package mcp implements a Model Context Protocol (MCP) server that exposes the sandbox lifecycle (create, exec, file IO, fork, terminate) as MCP tools over a JSON-RPC 2.0 stdio transport.
Package metering aggregates per-sandbox resource samples into a node report that accounts for copy-on-write (CoW) sharing across forks of the same template.
Package metering aggregates per-sandbox resource samples into a node report that accounts for copy-on-write (CoW) sharing across forks of the same template.
Package netconf holds pure, platform-independent helpers for sandbox network configuration: per-sandbox network identity allocation, nftables ruleset rendering, and command argument builders.
Package netconf holds pure, platform-independent helpers for sandbox network configuration: per-sandbox network identity allocation, nftables ruleset rendering, and command argument builders.
Package network applies and tears down per-sandbox host networking: a tap device, its host IP, and a per-tap nftables egress ruleset.
Package network applies and tears down per-sandbox host networking: a tap device, its host IP, and a per-tap nftables egress ruleset.
Package observability wires OpenTelemetry tracing for the control plane.
Package observability wires OpenTelemetry tracing for the control plane.
Package ociroot pulls OCI images and flattens them into a directory tree and an ext4 rootfs image suitable for booting inside a microVM.
Package ociroot pulls OCI images and flattens them into a directory tree and an ext4 rootfs image suitable for booting inside a microVM.
Package pki provides the internal certificate authority for the control plane: the controller and forkd authenticate each other with mTLS using exactly two leaf identities issued by this CA.
Package pki provides the internal certificate authority for the control plane: the controller and forkd authenticate each other with mTLS using exactly two leaf identities issued by this CA.
Package preview implements per-sandbox preview URLs: a signed, expiring URL (Daytona style) that names a sandbox and a port, plus a reverse proxy that resolves <label>.<domain> to the sandbox backend, verifies the signed token and the per-sandbox bearer gate, and proxies to the backend (issue #126).
Package preview implements per-sandbox preview URLs: a signed, expiring URL (Daytona style) that names a sandbox and a port, plus a reverse proxy that resolves <label>.<domain> to the sandbox backend, verifies the signed token and the per-sandbox bearer gate, and proxies to the backend (issue #126).
Package rendezvous is a minimal authenticated git-http rendezvous server: the real external remote the {git} workspace output pushes per-attempt branches to.
Package rendezvous is a minimal authenticated git-http rendezvous server: the real external remote the {git} workspace output pushes per-attempt branches to.
Package runmanifest parses and validates the mitos.yaml "Run with Mitos" manifest (schema v1) and maps it to the mitos primitives: a golden SandboxPool to fork from, plus the run, preview, secret, egress, workspace, and auto-update (track) intent the provisioner and the auto-update reconciler consume.
Package runmanifest parses and validates the mitos.yaml "Run with Mitos" manifest (schema v1) and maps it to the mitos primitives: a golden SandboxPool to fork from, plus the run, preview, secret, egress, workspace, and auto-update (track) intent the provisioner and the auto-update reconciler consume.
Package runservice turns a "Run with Mitos" click into a provisioned instance: it fetches a repo's mitos.yaml, ensures the golden SandboxPool, provisions the per-fork Sandbox and its Secret, applies them, and returns the live URL.
Package runservice turns a "Run with Mitos" click into a provisioned instance: it fetches a repo's mitos.yaml, ensures the golden SandboxPool, provisions the per-fork Sandbox and its Secret, applies them, and returns the live URL.
Package saas is the customer-facing front door for the hosted offering: real external accounts, organizations, memberships, and scoped API keys, layered ABOVE the internal mTLS and per-sandbox token plane (issue #210).
Package saas is the customer-facing front door for the hosted offering: real external accounts, organizations, memberships, and scoped API keys, layered ABOVE the internal mTLS and per-sandbox token plane (issue #210).
billing
Package billing wires the money for the hosted offering (issue #212): Stripe metered usage-based billing, plans, free signup credits, prepaid top-ups, hard/soft spend caps, and dunning, layered on top of the per-org UsageRecords from issue #211 and coordinated with the kill-switch from issue #213.
Package billing wires the money for the hosted offering (issue #212): Stripe metered usage-based billing, plans, free signup credits, prepaid top-ups, hard/soft spend caps, and dunning, layered on top of the per-org UsageRecords from issue #211 and coordinated with the kill-switch from issue #213.
billingprovider
Package billingprovider abstracts the payment backend behind a provider seam, the same way console.SecretStore abstracts the secret backend.
Package billingprovider abstracts the payment backend behind a provider seam, the same way console.SecretStore abstracts the secret backend.
billingprovider/paddle
Package paddle is the Paddle Billing implementation of billingprovider.Provider.
Package paddle is the Paddle Billing implementation of billingprovider.Provider.
billingprovider/stripe
Package stripe is the Stripe implementation of billingprovider.Provider.
Package stripe is the Stripe implementation of billingprovider.Provider.
console
The instance-operator plane: GET/POST /console/admin/...
The instance-operator plane: GET/POST /console/admin/...
console/baosecrets
Package baosecrets is the OpenBao (and Vault) SecretStore provider: the recommended external backend behind the console.SecretStore seam (spec §8).
Package baosecrets is the OpenBao (and Vault) SecretStore provider: the recommended external backend behind the console.SecretStore seam (spec §8).
console/clusterforktree
Package clusterforktree is the real console.ForkTreeSource: it builds an org's live fork tree from the controller's v1 Sandbox records scoped to one org.
Package clusterforktree is the real console.ForkTreeSource: it builds an org's live fork tree from the controller's v1 Sandbox records scoped to one org.
console/clusterinstruments
Package clusterinstruments is the real console.InstrumentsSource: it measures an org's proof snapshot from the controller's v1 Sandbox records scoped to one org.
Package clusterinstruments is the real console.InstrumentsSource: it measures an org's proof snapshot from the controller's v1 Sandbox records scoped to one org.
console/clusternodes
Package clusternodes is the real console.NodeSource: a read-only inventory of the cluster's Kubernetes nodes for the instance-operator plane's GET /console/admin/nodes.
Package clusternodes is the real console.NodeSource: a read-only inventory of the cluster's Kubernetes nodes for the instance-operator plane's GET /console/admin/nodes.
console/clustersandbox
Package clustersandbox is the real console.SandboxControl: it queries the controller's v1 Sandbox records scoped to one org, the cluster-backed implementation of the live-sandbox seam (issue #2).
Package clustersandbox is the real console.SandboxControl: it queries the controller's v1 Sandbox records scoped to one org, the cluster-backed implementation of the live-sandbox seam (issue #2).
console/kubesecrets
Package kubesecrets is the kube SecretStore provider: it materializes org secrets as namespaced Kubernetes Secrets, the self-host default backend behind the console.SecretStore seam (spec §8).
Package kubesecrets is the kube SecretStore provider: it materializes org secrets as namespaced Kubernetes Secrets, the self-host default backend behind the console.SecretStore seam (spec §8).
controlplane
Package controlplane is the real hosted control plane behind the public gateway (issue #210, ROADMAP SaaS P1).
Package controlplane is the real hosted control plane behind the public gateway (issue #210, ROADMAP SaaS P1).
oidcauth
Package oidcauth wires the browser OIDC login flow for the console: it drives the authorization-code redirect, exchanges the code, and turns the verified identity into a session cookie via the saas.LoginManager.
Package oidcauth wires the browser OIDC login flow for the console: it drives the authorization-code redirect, exchanges the code, and turns the verified identity into a session cookie via the saas.LoginManager.
onboarding
Package onboarding is the self-serve onboarding funnel for the hosted offering (issue #215): it ties together sign-up, email verification, auto-creation of a Personal organization (Daytona-style), the free-tier signup credit grant (the #212 ledger), and issuance of the first API key (#210), so a brand-new user reaches a first successful run_code in minutes with no card on the free tier and exactly one SDK package.
Package onboarding is the self-serve onboarding funnel for the hosted offering (issue #215): it ties together sign-up, email verification, auto-creation of a Personal organization (Daytona-style), the free-tier signup credit grant (the #212 ledger), and issuance of the first API key (#210), so a brand-new user reaches a first successful run_code in minutes with no card on the free tier and exactly one SDK package.
orgprovision
Package orgprovision implements the onboarding.OrgProvisioner seam over a controller-runtime client: a verified signup creates the cluster-scoped Org custom resource (api/v1.Org, name = org id), which the OrgReconciler turns into a per-org isolation namespace (issue #288).
Package orgprovision implements the onboarding.OrgProvisioner seam over a controller-runtime client: a verified signup creates the cluster-scoped Org custom resource (api/v1.Org, name = org id), which the OrgReconciler turns into a per-org isolation namespace (issue #288).
pgstore
Package pgstore is the durable Postgres implementation of saas.Store.
Package pgstore is the durable Postgres implementation of saas.Store.
placement
Package placement is the Phase 0 placement registry (issue #712): the operator-defined key and value set a deployment advertises for where a resource lives.
Package placement is the Phase 0 placement registry (issue #712): the operator-defined key and value set a deployment advertises for where a resource lives.
quota
Package quota is the abuse-control envelope for the hosted offering (issue #213): per-organization quotas, per-org and per-IP rate limiting, live concurrency and aggregate-resource caps, per-tier egress policy selection, and the kill-switch (org suspension).
Package quota is the abuse-control envelope for the hosted offering (issue #213): per-organization quotas, per-org and per-IP rate limiting, live concurrency and aggregate-resource caps, per-tier egress policy selection, and the kill-switch (org suspension).
storetest
Package storetest holds the shared behavioral contract for saas.Store.
Package storetest holds the shared behavioral contract for saas.Store.
Package sandboxrpc: GuestConn is the port (hexagonal architecture seam) between the Connect Sandbox service and the in-guest execution surface.
Package sandboxrpc: GuestConn is the port (hexagonal architecture seam) between the Connect Sandbox service and the in-guest execution surface.
Package snapcompat defines the snapshot compatibility contract: whether a snapshot captured in one environment can be safely restored in another.
Package snapcompat defines the snapshot compatibility contract: whether a snapshot captured in one environment can be safely restored in another.
Package sniproxy implements a host-side TLS SNI peek-and-splice egress filter for sandboxed guests.
Package sniproxy implements a host-side TLS SNI peek-and-splice egress filter for sandboxed guests.
Package storecrypt manages per-scope LUKS containers that hold template snapshots encrypted at rest.
Package storecrypt manages per-scope LUKS containers that hold template snapshots encrypted at rest.
Package telemetry is a privacy-first PRODUCT-USAGE telemetry pipeline for the hosted Mitos binaries.
Package telemetry is a privacy-first PRODUCT-USAGE telemetry pipeline for the hosted Mitos binaries.
Package templatebuild holds the pure, host-side logic for the declarative template builder (issue #220): the content-addressed cache key chained over the base image and each build step, the skip decision that reuses an unchanged prefix, and the typed build error.
Package templatebuild holds the pure, host-side logic for the declarative template builder (issue #220): the content-addressed cache key chained over the base image and each build step, the skip decision that reuses an unchanged prefix, and the typed build error.
Package tenant holds the canonical multi-tenancy convention shared across the SaaS surfaces: the org label stamped on tenant-owned objects and the hard per-org namespace each tenant's workloads live in.
Package tenant holds the canonical multi-tenancy convention shared across the SaaS surfaces: the org label stamped on tenant-owned objects and the hard per-org namespace each tenant's workloads live in.
Package usage turns per-node CoW-aware operational metering (internal/metering, the forkd GET /v1/metering endpoint) into per-organization, time-integrated, auditable usage records, and serves an org-scoped public usage API on top of them (issue #211).
Package usage turns per-node CoW-aware operational metering (internal/metering, the forkd GET /v1/metering endpoint) into per-organization, time-integrated, auditable usage records, and serves an org-scoped public usage API on top of them (issue #211).
usagestoretest
Package usagestoretest holds the shared behavioral contract for usage.UsageStore.
Package usagestoretest holds the shared behavioral contract for usage.UsageStore.
Package volume prepares per-sandbox block-device backing files on a forkd node.
Package volume prepares per-sandbox block-device backing files on a forkd node.
Package workspace holds the host-side hydrate/dehydrate helpers that move a sandbox's /workspace tree between a running guest and the content-addressed store (internal/cas).
Package workspace holds the host-side hydrate/dehydrate helpers that move a sandbox's /workspace tree between a running guest and the content-addressed store (internal/cas).

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL