microsandbox-rb 0.10.0 → 0.12.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +139 -0
- data/Cargo.lock +82 -95
- data/README.md +21 -13
- data/ext/microsandbox/Cargo.toml +4 -4
- data/ext/microsandbox/src/backend.rs +7 -9
- data/ext/microsandbox/src/error.rs +89 -1
- data/ext/microsandbox/src/image.rs +53 -5
- data/ext/microsandbox/src/lib.rs +9 -9
- data/ext/microsandbox/src/sandbox.rs +198 -55
- data/ext/microsandbox/src/snapshot.rs +79 -35
- data/ext/microsandbox/src/volume.rs +5 -3
- data/lib/microsandbox/errors.rb +16 -0
- data/lib/microsandbox/image.rb +38 -0
- data/lib/microsandbox/network.rb +139 -31
- data/lib/microsandbox/root_disk.rb +58 -0
- data/lib/microsandbox/sandbox.rb +174 -30
- data/lib/microsandbox/snapshot.rb +87 -37
- data/lib/microsandbox/version.rb +2 -2
- data/lib/microsandbox.rb +1 -0
- data/sig/microsandbox.rbs +51 -14
- metadata +2 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 72468dc2fa865510c82ecc783988925460acbd7f7d92025f367964277b98e756
|
|
4
|
+
data.tar.gz: f4bca46d64a694a76a59b712b8d827e6ddff12ba4cb9708a33951f4969c8fce2
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 31cace38acfb4b535aaeb5f9026acb4c63d5f1376637628c2947e1d5ff9c1492d388cde85f3ba38bd8d462bb0598d12f046467331a6507d6af2cd2720bb57137
|
|
7
|
+
data.tar.gz: 97e665bd96d8d7ae0719c34d5a7d7f7823966a70f793d251d034a519ad04da70a8925c0e17c01c854ab074de904aa9a1baa88b148f099afba33c751836f97a60
|
data/CHANGELOG.md
CHANGED
|
@@ -6,6 +6,145 @@ All notable changes to this gem are documented here. The format is based on
|
|
|
6
6
|
microsandbox runtime it embeds; each release notes the upstream runtime tag it
|
|
7
7
|
wraps, and the README's Versioning section keeps the full gem→runtime map.
|
|
8
8
|
|
|
9
|
+
## [0.12.0] - 2026-07-30
|
|
10
|
+
|
|
11
|
+
Adopts upstream runtime **`v0.6.7` → `v0.6.8`** and mirrors its breaking SDK
|
|
12
|
+
surface (upstream #1232 "unify cloud backend and paginated listings"), keeping
|
|
13
|
+
parity with the Python/Node SDKs.
|
|
14
|
+
|
|
15
|
+
### Breaking
|
|
16
|
+
|
|
17
|
+
- **Sandbox listing is cursor-paginated** (upstream #1232). `Sandbox.list` and
|
|
18
|
+
`Sandbox.list_with` now return a {Microsandbox::SandboxPage} — an Enumerable
|
|
19
|
+
page of `SandboxHandle`s carrying `#next_cursor` — instead of a plain Array.
|
|
20
|
+
`Sandbox.list` fetches the first page (upstream default size 20);
|
|
21
|
+
`Sandbox.list_with` gains `limit:` (1..100) and `cursor:` keywords alongside
|
|
22
|
+
the existing `labels:` filter. Code that only enumerates
|
|
23
|
+
(`list.each`/`map`/`to_a`) keeps working; code relying on the return value
|
|
24
|
+
*being* an Array (e.g. `list + other`, `Array ===`) must adapt, and listings
|
|
25
|
+
of more than one page must follow `page.next_cursor` via
|
|
26
|
+
`list_with(cursor:)`.
|
|
27
|
+
- **`UnsupportedError` messages are re-keyed by structured operations**
|
|
28
|
+
(upstream #1232): the core now reports the rejected API and a remedial hint
|
|
29
|
+
(e.g. `image.list is not supported by this backend: use a local backend`)
|
|
30
|
+
instead of the old free-text `feature`/`available_when` pair. The exception
|
|
31
|
+
additionally exposes the new structured attributes below.
|
|
32
|
+
|
|
33
|
+
### Added
|
|
34
|
+
|
|
35
|
+
- {Microsandbox::SandboxPage} — Enumerable over its `#sandboxes`, plus
|
|
36
|
+
`#next_cursor`, `#size`/`#length`, `#empty?` and `#last_page?`.
|
|
37
|
+
- `Sandbox.list_with(labels:, limit:, cursor:)` pagination keywords.
|
|
38
|
+
- `UnsupportedError#operation` / `#hint` — the rejected API in Ruby rendering
|
|
39
|
+
(`"sandbox.kill"`) and the remedial hint (`"use a local backend"`),
|
|
40
|
+
mirroring the Python SDK's enriched `UnsupportedError`.
|
|
41
|
+
|
|
42
|
+
### Changed
|
|
43
|
+
|
|
44
|
+
- Direct `VolumeFs` operations now route through the backend's volume trait
|
|
45
|
+
(upstream #1232) instead of a construction-time local-backend guard, so an
|
|
46
|
+
unsupported backend rejects each operation with a precise per-operation
|
|
47
|
+
error.
|
|
48
|
+
- The embedded runtime is `v0.6.8`; see the upstream release notes for
|
|
49
|
+
runtime-side changes (shared log registry for followed streams, cloud
|
|
50
|
+
sandbox reconnect fixes for `exec`/`ssh`, kernel sourced from
|
|
51
|
+
cdn.kernel.org).
|
|
52
|
+
|
|
53
|
+
## [0.11.0] - 2026-07-27
|
|
54
|
+
|
|
55
|
+
Adopts upstream runtime **`v0.6.6` → `v0.6.7`** and mirrors its breaking SDK
|
|
56
|
+
surface, keeping parity with the Python/Node SDKs (which ship the same renames
|
|
57
|
+
without compatibility aliases). The bundled runtime also carries the fix for
|
|
58
|
+
**GHSA-4vq3-cjpp-v7fg** (`msb copy` symlink traversal: a sandboxed workload
|
|
59
|
+
could make a later CLI copy-out overwrite an arbitrary host file — the SDK
|
|
60
|
+
`fs`/`copy_to_host` paths were not affected).
|
|
61
|
+
|
|
62
|
+
### Breaking
|
|
63
|
+
|
|
64
|
+
- **Network presets `public_only`/`non_local` are removed** (upstream #1198),
|
|
65
|
+
replaced by composable **profiles** `:public` / `:private` / `:host`:
|
|
66
|
+
`network: [:public, :private]`, single-profile sugar `network: :public`, or
|
|
67
|
+
`NetworkPolicy.from_profiles(:public, :host)`. Any non-empty profile set
|
|
68
|
+
automatically allows gateway DNS. The replacements are rule-for-rule
|
|
69
|
+
equivalent (`public_only` ≡ `[:public]`, which is still the default policy;
|
|
70
|
+
`non_local` ≡ `[:public, :private]`); the removed spellings (and
|
|
71
|
+
`NetworkPolicy.public_only`/`.non_local`) now raise an `ArgumentError` with
|
|
72
|
+
that migration guidance. `network: :none`/`:allow_all` (and their aliases)
|
|
73
|
+
and `network: :default` keep working unchanged. In the Hash form,
|
|
74
|
+
`profiles:` composes with `rules:`/`default_egress:`/`default_ingress:`/deny
|
|
75
|
+
lists; explicit `rules:` are evaluated **before** the profile expansion
|
|
76
|
+
(matching the upstream CLI), so a narrower override such as
|
|
77
|
+
`Rule.deny_dns` wins over a profile's allows under first-match-wins.
|
|
78
|
+
- **`Snapshot.create` is re-keyed by the snapshot's own name** (upstream
|
|
79
|
+
#1118): `Snapshot.create(name, from_sandbox:, dest_dir:, labels:, force:,
|
|
80
|
+
record_integrity:, resumable:)` — the positional argument is now the
|
|
81
|
+
snapshot name (was: the source sandbox), `from_sandbox:` is required, and
|
|
82
|
+
`path:` is replaced by `dest_dir:`, a **parent directory** (the artifact
|
|
83
|
+
always lands at `dest_dir/<name>`). `record_integrity:` is now a no-op
|
|
84
|
+
(schema-1 descriptors always record integrity); `resumable:` is accepted and
|
|
85
|
+
raises `UnsupportedError` until VM pause/resume lands upstream.
|
|
86
|
+
- **`Snapshot.export`/`Snapshot.import` are renamed `Snapshot.save`/
|
|
87
|
+
`Snapshot.load`** (same parameters), matching the Python/Node rename.
|
|
88
|
+
- **`SandboxHandle#snapshot_to` is removed** (deleted upstream). Use
|
|
89
|
+
`Snapshot.create(name, from_sandbox: handle_name, dest_dir: dir)` for
|
|
90
|
+
explicit placement.
|
|
91
|
+
- **`SnapshotVerifyReport#not_recorded?` is removed** and `#status` is always
|
|
92
|
+
`:verified`: integrity is now mandatory at snapshot-create time, so the
|
|
93
|
+
"not recorded" outcome no longer exists (a mismatch raises
|
|
94
|
+
`SnapshotIntegrityError` as before).
|
|
95
|
+
- **`SnapshotInfo#size_bytes`/`#format`/`#fstype` are now nilable** — nil for
|
|
96
|
+
the new checkpoint-state snapshots (file-state snapshots, the only kind
|
|
97
|
+
producible today, still populate all three).
|
|
98
|
+
|
|
99
|
+
### Added
|
|
100
|
+
|
|
101
|
+
- **Structured root disk** (upstream #1165) — `Sandbox.create(root_disk:)`
|
|
102
|
+
configures the OCI sandbox's writable layer: an Integer (managed ext4 upper
|
|
103
|
+
size cap in MiB, the old `oci_upper_size:` meaning), or a `RootDisk` factory
|
|
104
|
+
Hash: `RootDisk.managed(8192)`, `RootDisk.tmpfs(2048)` (RAM-backed, pristine
|
|
105
|
+
rootfs on every boot; size ≤ sandbox memory; not snapshot/patchable), or
|
|
106
|
+
`RootDisk.disk("./scratch.img", format:, fstype:)` (user-supplied image
|
|
107
|
+
attached writable; never created/resized/deleted by the runtime).
|
|
108
|
+
`oci_upper_size:` remains as a deprecated alias (warns; conflicts with
|
|
109
|
+
`root_disk:`).
|
|
110
|
+
- **`Image.load` / `Image.save`** (upstream #1151/#1174) — move OCI images in
|
|
111
|
+
and out of the local cache as `docker save`-style or OCI Image Layout
|
|
112
|
+
archives: `Image.load("./app.tar", tag: "app:dev")` (pass `"-"` to read
|
|
113
|
+
stdin; returns the loaded `ImageInfo`s) and
|
|
114
|
+
`Image.save("alpine:latest", output_path: "./alpine.tar", format: :docker)`.
|
|
115
|
+
- **`Rule.allow_dns` / `Rule.deny_dns`** — the gateway-DNS rule pair the
|
|
116
|
+
profiles expand to (egress → group `:host`, udp+tcp, port 53), for use in
|
|
117
|
+
custom policies (`deny_dns` upstream #1198).
|
|
118
|
+
- **Snapshot descriptor metadata** on `SnapshotInfo`: `#scope` (`:disk` /
|
|
119
|
+
`:resumable`), `#state_kind` (`"file"`/`"checkpoint"`), `#checkpoint_id`,
|
|
120
|
+
`#checkpoint_manifest_digest`, and the index columns `#locality`,
|
|
121
|
+
`#availability`, `#migration_state`, `#migration_error_code`.
|
|
122
|
+
- **`SnapshotMigrationError`** — raised when the automatic v0.6.6→v0.6.7
|
|
123
|
+
snapshot-descriptor migration is blocked and needs repair (new core
|
|
124
|
+
`SnapshotMigration` variant, upstream #1200).
|
|
125
|
+
- **`follow_root_symlinks:` volume flag** — per-mount opt-out of the runtime's
|
|
126
|
+
new default-on mount-root symlink protection (upstream #1149; bind/named
|
|
127
|
+
mounts only). The Rust SDK exposes the same switch; Python/Node defer it.
|
|
128
|
+
|
|
129
|
+
### Changed
|
|
130
|
+
|
|
131
|
+
- **Snapshot artifacts migrate on first use** (upstream #1200): the runtime
|
|
132
|
+
rewrites each v0.6.6 `manifest.json` descriptor to the v0.6.7
|
|
133
|
+
`snapshot.json` (keeping the old file as `.manifest.json.legacy`) at backend
|
|
134
|
+
connect, after which gems ≤ 0.10.x can no longer read those artifacts —
|
|
135
|
+
rolling back requires the upstream `msb self downgrade` tooling.
|
|
136
|
+
- **Bind/named mount roots refuse symlinked roots by default** (upstream
|
|
137
|
+
#1149) — opt out per mount with `follow_root_symlinks: true`.
|
|
138
|
+
- **DNS rebind protection is fail-closed for unspecified addresses** (upstream
|
|
139
|
+
#1198): `0.0.0.0`/`::` no longer classify as `public`, so a `public`-profile
|
|
140
|
+
sandbox can't be steered to them via DNS answers.
|
|
141
|
+
- `ModificationPlan` change/conflict entries for the managed upper now report
|
|
142
|
+
`field: "root_disk_size"` (was `"oci_upper_size"`) — the runtime's canonical
|
|
143
|
+
field name, passed through verbatim as always.
|
|
144
|
+
- Duplicate secret placeholders across secret entries are now allowed
|
|
145
|
+
(upstream #1178); snapshotting a tmpfs or disk-image root disk fails with a
|
|
146
|
+
purposeful `InvalidConfigError` (upstream #1169).
|
|
147
|
+
|
|
9
148
|
## [0.10.0] - 2026-07-09
|
|
10
149
|
|
|
11
150
|
Ruby bindings for the additive `v0.6.6` SDK surface (upstream #1099 / #1128),
|
data/Cargo.lock
CHANGED
|
@@ -1552,24 +1552,6 @@ version = "1.1.1"
|
|
|
1552
1552
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
1553
1553
|
checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"
|
|
1554
1554
|
|
|
1555
|
-
[[package]]
|
|
1556
|
-
name = "endian-type"
|
|
1557
|
-
version = "0.1.2"
|
|
1558
|
-
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
1559
|
-
checksum = "c34f04666d835ff5d62e058c3995147c06f42fe86ff053337632bca83e42702d"
|
|
1560
|
-
|
|
1561
|
-
[[package]]
|
|
1562
|
-
name = "enum-as-inner"
|
|
1563
|
-
version = "0.6.1"
|
|
1564
|
-
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
1565
|
-
checksum = "a1e6a265c649f3f5979b601d26f1d05ada116434c87741c9493cb56218f76cbc"
|
|
1566
|
-
dependencies = [
|
|
1567
|
-
"heck 0.5.0",
|
|
1568
|
-
"proc-macro2",
|
|
1569
|
-
"quote",
|
|
1570
|
-
"syn",
|
|
1571
|
-
]
|
|
1572
|
-
|
|
1573
1555
|
[[package]]
|
|
1574
1556
|
name = "enum_dispatch"
|
|
1575
1557
|
version = "0.3.13"
|
|
@@ -1616,7 +1598,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
1616
1598
|
checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
|
|
1617
1599
|
dependencies = [
|
|
1618
1600
|
"libc",
|
|
1619
|
-
"windows-sys 0.
|
|
1601
|
+
"windows-sys 0.59.0",
|
|
1620
1602
|
]
|
|
1621
1603
|
|
|
1622
1604
|
[[package]]
|
|
@@ -1906,11 +1888,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
1906
1888
|
checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
|
|
1907
1889
|
dependencies = [
|
|
1908
1890
|
"cfg-if",
|
|
1909
|
-
"js-sys",
|
|
1910
1891
|
"libc",
|
|
1911
1892
|
"r-efi 5.3.0",
|
|
1912
1893
|
"wasip2",
|
|
1913
|
-
"wasm-bindgen",
|
|
1914
1894
|
]
|
|
1915
1895
|
|
|
1916
1896
|
[[package]]
|
|
@@ -2095,48 +2075,47 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
|
2095
2075
|
checksum = "e712f64ec3850b98572bffac52e2c6f282b29fe6c5fa6d42334b30be438d95c1"
|
|
2096
2076
|
|
|
2097
2077
|
[[package]]
|
|
2098
|
-
name = "hickory-
|
|
2099
|
-
version = "0.26.
|
|
2078
|
+
name = "hickory-net"
|
|
2079
|
+
version = "0.26.1"
|
|
2100
2080
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
2101
|
-
checksum = "
|
|
2081
|
+
checksum = "e2295ed2f9c31e471e1428a8f88a3f0e1f4b27c15049592138d1eebe9c35b183"
|
|
2102
2082
|
dependencies = [
|
|
2083
|
+
"async-trait",
|
|
2084
|
+
"bytes",
|
|
2103
2085
|
"cfg-if",
|
|
2104
2086
|
"data-encoding",
|
|
2105
2087
|
"futures-channel",
|
|
2088
|
+
"futures-io",
|
|
2106
2089
|
"futures-util",
|
|
2107
2090
|
"hickory-proto",
|
|
2108
|
-
"
|
|
2109
|
-
"
|
|
2110
|
-
"
|
|
2091
|
+
"idna",
|
|
2092
|
+
"ipnet",
|
|
2093
|
+
"jni 0.22.4",
|
|
2094
|
+
"rand 0.10.2",
|
|
2095
|
+
"rustls",
|
|
2111
2096
|
"thiserror 2.0.18",
|
|
2097
|
+
"tinyvec",
|
|
2112
2098
|
"tokio",
|
|
2099
|
+
"tokio-rustls",
|
|
2113
2100
|
"tracing",
|
|
2101
|
+
"url",
|
|
2114
2102
|
]
|
|
2115
2103
|
|
|
2116
2104
|
[[package]]
|
|
2117
2105
|
name = "hickory-proto"
|
|
2118
|
-
version = "0.26.
|
|
2106
|
+
version = "0.26.1"
|
|
2119
2107
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
2120
|
-
checksum = "
|
|
2108
|
+
checksum = "0bab31817bfb44672a252e97fe81cd0c18d1b2cf892108922f6818820df8c643"
|
|
2121
2109
|
dependencies = [
|
|
2122
|
-
"async-trait",
|
|
2123
|
-
"bytes",
|
|
2124
|
-
"cfg-if",
|
|
2125
2110
|
"data-encoding",
|
|
2126
|
-
"enum-as-inner",
|
|
2127
|
-
"futures-channel",
|
|
2128
|
-
"futures-io",
|
|
2129
|
-
"futures-util",
|
|
2130
2111
|
"idna",
|
|
2131
2112
|
"ipnet",
|
|
2113
|
+
"jni 0.22.4",
|
|
2132
2114
|
"once_cell",
|
|
2133
|
-
"rand 0.
|
|
2115
|
+
"rand 0.10.2",
|
|
2134
2116
|
"ring",
|
|
2135
|
-
"rustls",
|
|
2136
2117
|
"thiserror 2.0.18",
|
|
2137
2118
|
"tinyvec",
|
|
2138
|
-
"tokio",
|
|
2139
|
-
"tokio-rustls",
|
|
2140
2119
|
"tracing",
|
|
2141
2120
|
"url",
|
|
2142
2121
|
]
|
|
@@ -2975,8 +2954,8 @@ dependencies = [
|
|
|
2975
2954
|
|
|
2976
2955
|
[[package]]
|
|
2977
2956
|
name = "microsandbox"
|
|
2978
|
-
version = "0.6.
|
|
2979
|
-
source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.
|
|
2957
|
+
version = "0.6.8"
|
|
2958
|
+
source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.8#7958cddeff2fce10dbcfd0c0d6a32dec93a9d5ea"
|
|
2980
2959
|
dependencies = [
|
|
2981
2960
|
"anyhow",
|
|
2982
2961
|
"astral-tokio-tar",
|
|
@@ -3011,6 +2990,7 @@ dependencies = [
|
|
|
3011
2990
|
"reqwest",
|
|
3012
2991
|
"russh",
|
|
3013
2992
|
"russh-sftp",
|
|
2993
|
+
"rustls",
|
|
3014
2994
|
"scopeguard",
|
|
3015
2995
|
"sea-orm",
|
|
3016
2996
|
"serde",
|
|
@@ -3023,6 +3003,8 @@ dependencies = [
|
|
|
3023
3003
|
"tokio-tungstenite",
|
|
3024
3004
|
"tracing",
|
|
3025
3005
|
"typed-builder",
|
|
3006
|
+
"typed-path",
|
|
3007
|
+
"webpki-roots 1.0.7",
|
|
3026
3008
|
"which",
|
|
3027
3009
|
"windows-sys 0.61.2",
|
|
3028
3010
|
"zeroize",
|
|
@@ -3030,8 +3012,8 @@ dependencies = [
|
|
|
3030
3012
|
|
|
3031
3013
|
[[package]]
|
|
3032
3014
|
name = "microsandbox-agent-client"
|
|
3033
|
-
version = "0.6.
|
|
3034
|
-
source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.
|
|
3015
|
+
version = "0.6.8"
|
|
3016
|
+
source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.8#7958cddeff2fce10dbcfd0c0d6a32dec93a9d5ea"
|
|
3035
3017
|
dependencies = [
|
|
3036
3018
|
"ciborium",
|
|
3037
3019
|
"microsandbox-protocol",
|
|
@@ -3043,8 +3025,8 @@ dependencies = [
|
|
|
3043
3025
|
|
|
3044
3026
|
[[package]]
|
|
3045
3027
|
name = "microsandbox-db"
|
|
3046
|
-
version = "0.6.
|
|
3047
|
-
source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.
|
|
3028
|
+
version = "0.6.8"
|
|
3029
|
+
source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.8#7958cddeff2fce10dbcfd0c0d6a32dec93a9d5ea"
|
|
3048
3030
|
dependencies = [
|
|
3049
3031
|
"async-trait",
|
|
3050
3032
|
"sea-orm",
|
|
@@ -3055,8 +3037,8 @@ dependencies = [
|
|
|
3055
3037
|
|
|
3056
3038
|
[[package]]
|
|
3057
3039
|
name = "microsandbox-filesystem"
|
|
3058
|
-
version = "0.6.
|
|
3059
|
-
source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.
|
|
3040
|
+
version = "0.6.8"
|
|
3041
|
+
source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.8#7958cddeff2fce10dbcfd0c0d6a32dec93a9d5ea"
|
|
3060
3042
|
dependencies = [
|
|
3061
3043
|
"libc",
|
|
3062
3044
|
"microsandbox-utils",
|
|
@@ -3068,11 +3050,12 @@ dependencies = [
|
|
|
3068
3050
|
|
|
3069
3051
|
[[package]]
|
|
3070
3052
|
name = "microsandbox-image"
|
|
3071
|
-
version = "0.6.
|
|
3072
|
-
source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.
|
|
3053
|
+
version = "0.6.8"
|
|
3054
|
+
source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.8#7958cddeff2fce10dbcfd0c0d6a32dec93a9d5ea"
|
|
3073
3055
|
dependencies = [
|
|
3074
3056
|
"astral-tokio-tar",
|
|
3075
3057
|
"async-compression",
|
|
3058
|
+
"chrono",
|
|
3076
3059
|
"futures",
|
|
3077
3060
|
"hex",
|
|
3078
3061
|
"libc",
|
|
@@ -3094,8 +3077,8 @@ dependencies = [
|
|
|
3094
3077
|
|
|
3095
3078
|
[[package]]
|
|
3096
3079
|
name = "microsandbox-metrics"
|
|
3097
|
-
version = "0.6.
|
|
3098
|
-
source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.
|
|
3080
|
+
version = "0.6.8"
|
|
3081
|
+
source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.8#7958cddeff2fce10dbcfd0c0d6a32dec93a9d5ea"
|
|
3099
3082
|
dependencies = [
|
|
3100
3083
|
"chrono",
|
|
3101
3084
|
"libc",
|
|
@@ -3106,8 +3089,8 @@ dependencies = [
|
|
|
3106
3089
|
|
|
3107
3090
|
[[package]]
|
|
3108
3091
|
name = "microsandbox-migration"
|
|
3109
|
-
version = "0.6.
|
|
3110
|
-
source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.
|
|
3092
|
+
version = "0.6.8"
|
|
3093
|
+
source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.8#7958cddeff2fce10dbcfd0c0d6a32dec93a9d5ea"
|
|
3111
3094
|
dependencies = [
|
|
3112
3095
|
"sea-orm-migration",
|
|
3113
3096
|
"serde_json",
|
|
@@ -3115,8 +3098,8 @@ dependencies = [
|
|
|
3115
3098
|
|
|
3116
3099
|
[[package]]
|
|
3117
3100
|
name = "microsandbox-network"
|
|
3118
|
-
version = "0.6.
|
|
3119
|
-
source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.
|
|
3101
|
+
version = "0.6.8"
|
|
3102
|
+
source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.8#7958cddeff2fce10dbcfd0c0d6a32dec93a9d5ea"
|
|
3120
3103
|
dependencies = [
|
|
3121
3104
|
"base64",
|
|
3122
3105
|
"bytes",
|
|
@@ -3124,7 +3107,7 @@ dependencies = [
|
|
|
3124
3107
|
"crossbeam-queue",
|
|
3125
3108
|
"dirs",
|
|
3126
3109
|
"futures",
|
|
3127
|
-
"hickory-
|
|
3110
|
+
"hickory-net",
|
|
3128
3111
|
"hickory-proto",
|
|
3129
3112
|
"httlib-hpack",
|
|
3130
3113
|
"httparse",
|
|
@@ -3159,8 +3142,8 @@ dependencies = [
|
|
|
3159
3142
|
|
|
3160
3143
|
[[package]]
|
|
3161
3144
|
name = "microsandbox-protocol"
|
|
3162
|
-
version = "0.6.
|
|
3163
|
-
source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.
|
|
3145
|
+
version = "0.6.8"
|
|
3146
|
+
source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.8#7958cddeff2fce10dbcfd0c0d6a32dec93a9d5ea"
|
|
3164
3147
|
dependencies = [
|
|
3165
3148
|
"chrono",
|
|
3166
3149
|
"ciborium",
|
|
@@ -3174,8 +3157,8 @@ dependencies = [
|
|
|
3174
3157
|
|
|
3175
3158
|
[[package]]
|
|
3176
3159
|
name = "microsandbox-runtime"
|
|
3177
|
-
version = "0.6.
|
|
3178
|
-
source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.
|
|
3160
|
+
version = "0.6.8"
|
|
3161
|
+
source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.8#7958cddeff2fce10dbcfd0c0d6a32dec93a9d5ea"
|
|
3179
3162
|
dependencies = [
|
|
3180
3163
|
"bytes",
|
|
3181
3164
|
"chrono",
|
|
@@ -3206,10 +3189,11 @@ dependencies = [
|
|
|
3206
3189
|
|
|
3207
3190
|
[[package]]
|
|
3208
3191
|
name = "microsandbox-types"
|
|
3209
|
-
version = "0.6.
|
|
3210
|
-
source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.
|
|
3192
|
+
version = "0.6.8"
|
|
3193
|
+
source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.8#7958cddeff2fce10dbcfd0c0d6a32dec93a9d5ea"
|
|
3211
3194
|
dependencies = [
|
|
3212
3195
|
"chrono",
|
|
3196
|
+
"ipnetwork",
|
|
3213
3197
|
"serde",
|
|
3214
3198
|
"serde_json",
|
|
3215
3199
|
"sha2 0.11.0",
|
|
@@ -3219,8 +3203,8 @@ dependencies = [
|
|
|
3219
3203
|
|
|
3220
3204
|
[[package]]
|
|
3221
3205
|
name = "microsandbox-utils"
|
|
3222
|
-
version = "0.6.
|
|
3223
|
-
source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.
|
|
3206
|
+
version = "0.6.8"
|
|
3207
|
+
source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.8#7958cddeff2fce10dbcfd0c0d6a32dec93a9d5ea"
|
|
3224
3208
|
dependencies = [
|
|
3225
3209
|
"dirs",
|
|
3226
3210
|
"libc",
|
|
@@ -3232,7 +3216,7 @@ dependencies = [
|
|
|
3232
3216
|
|
|
3233
3217
|
[[package]]
|
|
3234
3218
|
name = "microsandbox_rb"
|
|
3235
|
-
version = "0.
|
|
3219
|
+
version = "0.12.0"
|
|
3236
3220
|
dependencies = [
|
|
3237
3221
|
"chrono",
|
|
3238
3222
|
"futures",
|
|
@@ -3491,15 +3475,6 @@ dependencies = [
|
|
|
3491
3475
|
"zstd",
|
|
3492
3476
|
]
|
|
3493
3477
|
|
|
3494
|
-
[[package]]
|
|
3495
|
-
name = "nibble_vec"
|
|
3496
|
-
version = "0.1.0"
|
|
3497
|
-
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
3498
|
-
checksum = "77a5d83df9f36fe23f0c3648c6bbb8b0298bb5f1939c8f2704431371f4b84d43"
|
|
3499
|
-
dependencies = [
|
|
3500
|
-
"smallvec",
|
|
3501
|
-
]
|
|
3502
|
-
|
|
3503
3478
|
[[package]]
|
|
3504
3479
|
name = "nix"
|
|
3505
3480
|
version = "0.29.0"
|
|
@@ -4248,15 +4223,16 @@ dependencies = [
|
|
|
4248
4223
|
|
|
4249
4224
|
[[package]]
|
|
4250
4225
|
name = "quinn-proto"
|
|
4251
|
-
version = "0.11.
|
|
4226
|
+
version = "0.11.16"
|
|
4252
4227
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
4253
|
-
checksum = "
|
|
4228
|
+
checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560"
|
|
4254
4229
|
dependencies = [
|
|
4255
4230
|
"aws-lc-rs",
|
|
4256
4231
|
"bytes",
|
|
4257
|
-
"getrandom 0.
|
|
4232
|
+
"getrandom 0.4.2",
|
|
4258
4233
|
"lru-slab",
|
|
4259
|
-
"rand 0.
|
|
4234
|
+
"rand 0.10.2",
|
|
4235
|
+
"rand_pcg",
|
|
4260
4236
|
"ring",
|
|
4261
4237
|
"rustc-hash",
|
|
4262
4238
|
"rustls",
|
|
@@ -4303,16 +4279,6 @@ version = "6.0.0"
|
|
|
4303
4279
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
4304
4280
|
checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
|
|
4305
4281
|
|
|
4306
|
-
[[package]]
|
|
4307
|
-
name = "radix_trie"
|
|
4308
|
-
version = "0.2.1"
|
|
4309
|
-
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
4310
|
-
checksum = "c069c179fcdc6a2fe24d8d18305cf085fdbd4f922c041943e203685d6a1c58fd"
|
|
4311
|
-
dependencies = [
|
|
4312
|
-
"endian-type",
|
|
4313
|
-
"nibble_vec",
|
|
4314
|
-
]
|
|
4315
|
-
|
|
4316
4282
|
[[package]]
|
|
4317
4283
|
name = "rand"
|
|
4318
4284
|
version = "0.8.6"
|
|
@@ -4389,6 +4355,15 @@ version = "0.10.1"
|
|
|
4389
4355
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
4390
4356
|
checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
|
|
4391
4357
|
|
|
4358
|
+
[[package]]
|
|
4359
|
+
name = "rand_pcg"
|
|
4360
|
+
version = "0.10.2"
|
|
4361
|
+
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
4362
|
+
checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
|
|
4363
|
+
dependencies = [
|
|
4364
|
+
"rand_core 0.10.1",
|
|
4365
|
+
]
|
|
4366
|
+
|
|
4392
4367
|
[[package]]
|
|
4393
4368
|
name = "rb-sys"
|
|
4394
4369
|
version = "0.9.128"
|
|
@@ -4766,7 +4741,7 @@ dependencies = [
|
|
|
4766
4741
|
"errno",
|
|
4767
4742
|
"libc",
|
|
4768
4743
|
"linux-raw-sys",
|
|
4769
|
-
"windows-sys 0.
|
|
4744
|
+
"windows-sys 0.59.0",
|
|
4770
4745
|
]
|
|
4771
4746
|
|
|
4772
4747
|
[[package]]
|
|
@@ -4834,7 +4809,7 @@ dependencies = [
|
|
|
4834
4809
|
"security-framework 3.7.0",
|
|
4835
4810
|
"security-framework-sys",
|
|
4836
4811
|
"webpki-root-certs",
|
|
4837
|
-
"windows-sys 0.
|
|
4812
|
+
"windows-sys 0.59.0",
|
|
4838
4813
|
]
|
|
4839
4814
|
|
|
4840
4815
|
[[package]]
|
|
@@ -4855,7 +4830,7 @@ dependencies = [
|
|
|
4855
4830
|
"security-framework 3.7.0",
|
|
4856
4831
|
"security-framework-sys",
|
|
4857
4832
|
"webpki-root-certs",
|
|
4858
|
-
"windows-sys 0.
|
|
4833
|
+
"windows-sys 0.59.0",
|
|
4859
4834
|
]
|
|
4860
4835
|
|
|
4861
4836
|
[[package]]
|
|
@@ -5385,9 +5360,9 @@ checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
|
|
|
5385
5360
|
|
|
5386
5361
|
[[package]]
|
|
5387
5362
|
name = "simd_cesu8"
|
|
5388
|
-
version = "1.
|
|
5363
|
+
version = "1.2.0"
|
|
5389
5364
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
5390
|
-
checksum = "
|
|
5365
|
+
checksum = "11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520"
|
|
5391
5366
|
dependencies = [
|
|
5392
5367
|
"rustc_version",
|
|
5393
5368
|
"simdutf8",
|
|
@@ -5875,7 +5850,7 @@ dependencies = [
|
|
|
5875
5850
|
"getrandom 0.4.2",
|
|
5876
5851
|
"once_cell",
|
|
5877
5852
|
"rustix",
|
|
5878
|
-
"windows-sys 0.
|
|
5853
|
+
"windows-sys 0.59.0",
|
|
5879
5854
|
]
|
|
5880
5855
|
|
|
5881
5856
|
[[package]]
|
|
@@ -6039,8 +6014,12 @@ checksum = "8f72a05e828585856dacd553fba484c242c46e391fb0e58917c942ee9202915c"
|
|
|
6039
6014
|
dependencies = [
|
|
6040
6015
|
"futures-util",
|
|
6041
6016
|
"log",
|
|
6017
|
+
"rustls",
|
|
6018
|
+
"rustls-pki-types",
|
|
6042
6019
|
"tokio",
|
|
6020
|
+
"tokio-rustls",
|
|
6043
6021
|
"tungstenite",
|
|
6022
|
+
"webpki-roots 0.26.11",
|
|
6044
6023
|
]
|
|
6045
6024
|
|
|
6046
6025
|
[[package]]
|
|
@@ -6197,6 +6176,8 @@ dependencies = [
|
|
|
6197
6176
|
"httparse",
|
|
6198
6177
|
"log",
|
|
6199
6178
|
"rand 0.9.4",
|
|
6179
|
+
"rustls",
|
|
6180
|
+
"rustls-pki-types",
|
|
6200
6181
|
"sha1 0.10.6",
|
|
6201
6182
|
"thiserror 2.0.18",
|
|
6202
6183
|
]
|
|
@@ -6221,6 +6202,12 @@ dependencies = [
|
|
|
6221
6202
|
"syn",
|
|
6222
6203
|
]
|
|
6223
6204
|
|
|
6205
|
+
[[package]]
|
|
6206
|
+
name = "typed-path"
|
|
6207
|
+
version = "0.12.3"
|
|
6208
|
+
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
6209
|
+
checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
|
|
6210
|
+
|
|
6224
6211
|
[[package]]
|
|
6225
6212
|
name = "typenum"
|
|
6226
6213
|
version = "1.20.1"
|
data/README.md
CHANGED
|
@@ -39,7 +39,7 @@ them. Our deepest thanks to the maintainers and community. 🙏
|
|
|
39
39
|
- **Guest filesystem access** — read, write, list, copy, stat files inside a running sandbox
|
|
40
40
|
- **Metrics & logs** — CPU, memory, disk and network I/O; captured stdout/stderr/system logs
|
|
41
41
|
- **Rootfs patches** — inject files, dirs, and symlinks into the image before boot (`Microsandbox::Patch`)
|
|
42
|
-
- **Fine-grained networking** —
|
|
42
|
+
- **Fine-grained networking** — composable profiles (`:public`/`:private`/`:host`) *and* custom CIDR/domain/group allow-deny rules (`Microsandbox::NetworkPolicy`)
|
|
43
43
|
- **SSH & SFTP** — native in-process SSH client/server and file transfer (`Sandbox#ssh`)
|
|
44
44
|
- **Raw agent client** — byte-level access to the guest `agentd` protocol (`Microsandbox::AgentClient`)
|
|
45
45
|
- **Idiomatic Ruby** — keyword arguments, block-scoped lifecycle, a typed error hierarchy
|
|
@@ -126,10 +126,13 @@ ensure
|
|
|
126
126
|
# sb.kill # force (SIGKILL); sb.drain for a graceful drain
|
|
127
127
|
end
|
|
128
128
|
|
|
129
|
-
# Inspect / manage existing sandboxes. `get
|
|
129
|
+
# Inspect / manage existing sandboxes. `get` returns a controllable
|
|
130
130
|
# SandboxHandle (the live `stop`/`kill`/`drain`/`wait` live on the object from
|
|
131
|
-
# `create`/`start`; fine-grained control lives on the handle).
|
|
132
|
-
|
|
131
|
+
# `create`/`start`; fine-grained control lives on the handle). `list` returns a
|
|
132
|
+
# cursor-paginated, Enumerable SandboxPage of handles (runtime v0.6.8).
|
|
133
|
+
Microsandbox::Sandbox.list # => Microsandbox::SandboxPage (first page)
|
|
134
|
+
Microsandbox::Sandbox.list.map(&:name) # enumerate the page's handles
|
|
135
|
+
# next page: Sandbox.list_with(cursor: page.next_cursor, limit: 50)
|
|
133
136
|
h = Microsandbox::Sandbox.get("box") # => Microsandbox::SandboxHandle
|
|
134
137
|
h.status # :running, :stopped, :created, ...
|
|
135
138
|
h.stop_with_timeout(5) # custom escalation timeout
|
|
@@ -160,7 +163,7 @@ Microsandbox::Sandbox.create(
|
|
|
160
163
|
workdir: "/app",
|
|
161
164
|
labels: { "team" => "research" },
|
|
162
165
|
ports: { 8080 => 80 }, # host => guest (TCP)
|
|
163
|
-
network:
|
|
166
|
+
network: [:public], # composable profiles; :none for airgapped
|
|
164
167
|
replace: true # replace an existing sandbox of the same name
|
|
165
168
|
) do |sb|
|
|
166
169
|
# ...
|
|
@@ -442,8 +445,8 @@ change diverged the two numbers — the gem version is **not** a reliable indica
|
|
|
442
445
|
of the embedded runtime version. To learn which runtime a build wraps, ask it:
|
|
443
446
|
|
|
444
447
|
```ruby
|
|
445
|
-
Microsandbox::VERSION # => "0.
|
|
446
|
-
Microsandbox.runtime_version # => "v0.6.
|
|
448
|
+
Microsandbox::VERSION # => "0.12.0" (the gem's own version)
|
|
449
|
+
Microsandbox.runtime_version # => "v0.6.8" (the embedded upstream runtime tag)
|
|
447
450
|
```
|
|
448
451
|
|
|
449
452
|
| Gem version | Upstream runtime | Notes |
|
|
@@ -464,6 +467,8 @@ Microsandbox.runtime_version # => "v0.6.6" (the embedded upstream runtime tag
|
|
|
464
467
|
| `0.9.2` | `v0.6.3` | adopts upstream `v0.6.3` (v4-only sandboxes stop advertising AAAA DNS answers — fixes guest gRPC/c-ares preferring unreachable IPv6; scoped upstream TLS verification); glue moves to `*_local` SDK variants — no Ruby surface change |
|
|
465
468
|
| `0.9.3` | `v0.6.6` | adopts upstream `v0.6.4`+`v0.6.6` (`v0.6.5` was yanked upstream): snapshot restore by pinned digest — fixes fatal restore-after-tag-republish bug, fragmented-UDP/PMTU relay fixes, exec kills the whole process group, ephemeral stop-wait tolerance, readdir RSS-leak fix; upstream API growth is additive-only — no Ruby surface change |
|
|
466
469
|
| `0.10.0` | `v0.6.6` | `v0.6.6` API parity: live `modify`/resize, `ping`/`touch`, create `max_cpus`/`max_memory` |
|
|
470
|
+
| `0.11.0` | `v0.6.7` | adopts upstream `v0.6.7` (**breaking**): network profiles replace `public_only`/`non_local`, structured `root_disk:` replaces `oci_upper_size:` (deprecated alias kept), snapshot descriptor contract (`create` re-keyed by name, `save`/`load` rename, `snapshot_to` removed, on-disk auto-migration), `Image.load`/`Image.save`, `follow_root_symlinks:`; runtime carries the GHSA-4vq3-cjpp-v7fg `msb copy` fix |
|
|
471
|
+
| `0.12.0` | `v0.6.8` | adopts upstream `v0.6.8` (**breaking**): `Sandbox.list`/`.list_with` return a cursor-paginated `SandboxPage` (`limit:`/`cursor:` keywords), `UnsupportedError` re-keyed by structured operations with `#operation`/`#hint`; runtime adds a shared log registry for followed streams and cloud exec/ssh reconnects |
|
|
467
472
|
|
|
468
473
|
**Going forward** — the gem version moves on its own semver track and no longer
|
|
469
474
|
mirrors the upstream tag:
|
|
@@ -542,18 +547,21 @@ section. The binding covers the official-SDK surface: sandbox
|
|
|
542
547
|
lifecycle (the live `Sandbox` `stop`/`stop_and_wait`/`kill`/`drain`/`wait`/
|
|
543
548
|
`status`/`detach`/`owns_lifecycle?`, plus the `SandboxHandle` controls
|
|
544
549
|
`stop_with_timeout`/`request_stop`/`request_kill`/`request_drain`/
|
|
545
|
-
`wait_until_stopped`/`config`/`config_json`/`snapshot
|
|
546
|
-
`Sandbox.get`, and
|
|
550
|
+
`wait_until_stopped`/`config`/`config_json`/`snapshot` from
|
|
551
|
+
`Sandbox.get`, and the cursor-paginated `list`/`list_with` with label
|
|
552
|
+
filters),
|
|
547
553
|
backend routing (`set_default_backend`/`with_backend`/`default_backend_kind`),
|
|
548
554
|
`exec`/`shell` (collected and streaming), interactive `attach`/
|
|
549
555
|
`attach_shell`, the full guest filesystem (incl. streaming `read_stream`/
|
|
550
556
|
`write_stream`), metrics (per-sandbox, `Microsandbox.all_sandbox_metrics`, and
|
|
551
557
|
streaming `metrics_stream`/`log_stream`), logs, OCI image-cache management,
|
|
552
558
|
named volumes (incl. host-side `Volume.fs`/`VolumeInfo#fs` read/write),
|
|
553
|
-
snapshots (create/open/list/list_dir/reindex/verify/
|
|
554
|
-
boot-from-snapshot),
|
|
555
|
-
(`Sandbox.create_with_progress` → `PullSession`),
|
|
556
|
-
(`Microsandbox::Patch`), **
|
|
559
|
+
snapshots (create/open/list/list_dir/reindex/verify/save/load +
|
|
560
|
+
boot-from-snapshot), image archives (`Image.load`/`Image.save`), streaming
|
|
561
|
+
image-pull progress (`Sandbox.create_with_progress` → `PullSession`),
|
|
562
|
+
**rootfs patches** (`Microsandbox::Patch`), the structured **root disk**
|
|
563
|
+
(`root_disk:` managed/tmpfs/disk via `Microsandbox::RootDisk`), **network
|
|
564
|
+
configuration** (composable profiles, custom per-rule
|
|
557
565
|
`Microsandbox::NetworkPolicy`/`Rule`/`Destination`, plus DNS, TLS interception,
|
|
558
566
|
IPv4/IPv6 pools, `max_connections`, `trust_host_cas`), **secrets** (multi-host /
|
|
559
567
|
wildcard allow-lists, injection toggles, per-secret + sandbox-level violation
|