microsandbox-rb 0.5.10 → 0.5.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d4d9e8db2dddac7a22c2910c82a56603e95ad702d328c6a020f514997d29859c
-  data.tar.gz: 5f19089f8d1d0f18d5d930cf49576d25862f02323495ffa02db683f57a3439cd
+  metadata.gz: a2d0013cf55f89aa21492847859554937ff838d5d38d4f5f34d0e8da473c9554
+  data.tar.gz: 95bd9d994905567facd356597a8fee6e7f25715a485edbbc48bf98bb09f90eb3
 SHA512:
-  metadata.gz: 88e44654909dd3f39ac23c6cf682bd62519bbaf7f57ca24f611a66e05bb66c825919fc1f2be6f9044513c99508bfedd412e5c72c1f15fc8b66c3ac11ee2b78ac
-  data.tar.gz: 00b0f44a4568107891a2ce9a623950245457ea51d0700f45333b96fec7eb73e6572b8b9b67b4147490423687fa1ff7dcb96b6edd29c2aa28c3ed22807eab7bdb
+  metadata.gz: 337de8ed90dfea5b44d959579a16dafdd736e33fbfff7e10ed8ad4678184f84bdf417f33d85a7a8f11ab69a4785a91c381ea719600769b804d9a71c1c048adb1
+  data.tar.gz: 672d7c7945e3a5561ad9934bc682b5f9764d1873d4235105e33ca1494a0079d11e574d520ed0e1f90bb66049264cdc783180448d2f456c78185024d9f18b186d

data/CHANGELOG.md

@@ -6,6 +6,20 @@ upstream microsandbox runtime.
 
 ## [Unreleased]
 
+## [0.5.11] - 2026-06-23
+
+### Added
+
+- **Read-only / mount-option passthrough for volumes.** A volume spec Hash may
+  now carry `ro:`/`readonly:`, `noexec:`, `nosuid:`, `nodev:`, or an explicit
+  `options:` array, e.g. `volumes: { "/repos" => { bind: "/host/repos", ro: true } }`.
+  The Ruby layer appends a 4th comma-joined options element to the normalized
+  mount triple and the native ext applies the matching `MountBuilder` flags. RO is
+  enforced both host-side (virtiofs rejects writes) and guest-side (kernel returns
+  `EROFS`). Previously the gem could only request read-write mounts, so callers had
+  to fake read-only with host `chmod -R a-w`. Backward compatible: String specs and
+  option-less Hash specs serialize to the exact same 3-element triple as before.
+
 ## [0.5.10] - 2026-06-22
 
 ### Added

data/Cargo.lock

@@ -3249,7 +3249,7 @@ dependencies = [
 
 [[package]]
 name = "microsandbox_rb"
-version = "0.5.10"
+version = "0.5.11"
 dependencies = [
  "chrono",
  "futures",

data/ext/microsandbox/Cargo.toml

@@ -7,7 +7,7 @@ description = "Ruby SDK native extension for microsandbox — secure, fast micro
 # Must equal Microsandbox::VERSION (lib/microsandbox/version.rb) — Native.version
 # returns this via env!("CARGO_PKG_VERSION") and version_spec.rb asserts equality.
 # The core-crate dependency below stays pinned at its own tag (v0.5.8).
-version = "0.5.10"
+version = "0.5.11"
 authors = ["Super Rad Company <development@superrad.company>"]
 repository = "https://github.com/superradcompany/microsandbox"
 license = "Apache-2.0"

data/ext/microsandbox/src/sandbox.rs

@@ -89,9 +89,11 @@ impl Sandbox {
         for (host, guest) in conv::opt_port_map(opts, "ports")? {
             b = b.port(host, guest);
         }
-        // volumes: normalized by the Ruby layer to [guest, kind, source] triples.
+        // volumes: normalized by the Ruby layer to [guest, kind, source] triples,
+        // or [guest, kind, source, options] quads where options is a comma-joined
+        // list (ro/readonly, rw, noexec, nosuid, nodev).
         for spec in conv::opt::<Vec<Vec<String>>>(opts, "volumes")?.unwrap_or_default() {
-            if spec.len() != 3 {
+            if spec.len() < 3 || spec.len() > 4 {
                 return Err(error::base_error("invalid volume mount spec"));
             }
             let (guest, kind, source) = (spec[0].clone(), spec[1].clone(), spec[2].clone());
@@ -103,12 +105,43 @@ impl Sandbox {
                     )))
                 }
             }
+            // Validate options up front (the volume closure cannot return an error).
+            let mount_opts: Vec<String> = spec
+                .get(3)
+                .map(|s| {
+                    s.split(',')
+                        .map(|o| o.trim().to_string())
+                        .filter(|o| !o.is_empty())
+                        .collect()
+                })
+                .unwrap_or_default();
+            for opt in &mount_opts {
+                match opt.as_str() {
+                    "ro" | "readonly" | "rw" | "noexec" | "nosuid" | "nodev" => {}
+                    other => {
+                        return Err(error::base_error(format!(
+                            "unknown volume mount option {other:?} \
+                             (expected ro/rw/noexec/nosuid/nodev)"
+                        )))
+                    }
+                }
+            }
             b = b.volume(guest, move |m| {
-                if kind == "named" {
+                let mut m = if kind == "named" {
                     m.named(source)
                 } else {
                     m.bind(source)
+                };
+                for opt in &mount_opts {
+                    m = match opt.as_str() {
+                        "ro" | "readonly" => m.readonly(),
+                        "noexec" => m.noexec(),
+                        "nosuid" => m.nosuid(),
+                        "nodev" => m.nodev(),
+                        _ => m, // "rw" — default; already validated above
+                    };
                 }
+                m
             });
         }
         // patches: rootfs modifications applied before boot. The Ruby layer

data/lib/microsandbox/sandbox.rb

@@ -387,8 +387,10 @@ module Microsandbox
       end
 
       # Normalize volumes (Hash of guest_path => spec) into [guest, kind, source]
-      # triples for the native layer. A spec is a host path String (bind mount),
-      # or a Hash { bind: "/host" } / { named: "volume-name" }.
+      # triples (or [guest, kind, source, options] quads) for the native layer. A
+      # spec is a host path String (read-write bind mount), or a Hash
+      # { bind: "/host" } / { named: "volume-name" } optionally carrying mount
+      # options: { bind: "/host", ro: true } / { named: "v", options: %w[ro noexec] }.
       def normalize_volumes(volumes)
         volumes.map do |guest, spec|
           guest = guest.to_s
@@ -396,19 +398,39 @@ module Microsandbox
           when String
             [guest, "bind", spec]
           when Hash
-            if (named = spec[:named] || spec["named"])
-              [guest, "named", named.to_s]
-            elsif (bind = spec[:bind] || spec["bind"])
-              [guest, "bind", bind.to_s]
-            else
-              raise ArgumentError, "volume spec for #{guest.inspect} needs :bind or :named"
-            end
+            triple =
+              if (named = spec[:named] || spec["named"])
+                [guest, "named", named.to_s]
+              elsif (bind = spec[:bind] || spec["bind"])
+                [guest, "bind", bind.to_s]
+              else
+                raise ArgumentError, "volume spec for #{guest.inspect} needs :bind or :named"
+              end
+            # Optional 4th element: comma-joined mount options. Omitted when empty
+            # so existing [guest,kind,source] consumers and the common read-write
+            # case are byte-for-byte unchanged.
+            opts = mount_options(spec)
+            opts.empty? ? triple : triple + [opts.join(",")]
           else
             raise ArgumentError, "invalid volume spec for #{guest.inspect}: #{spec.inspect}"
           end
         end
       end
 
+      # Collect mount options from a volume spec Hash. `ro:`/`readonly:` makes the
+      # mount read-only (host virtiofs rejects writes + guest kernel returns EROFS);
+      # `noexec:`/`nosuid:`/`nodev:` set the matching flags; an explicit `options:`
+      # array passes through verbatim. Unknown options are rejected natively.
+      def mount_options(spec)
+        opts = []
+        opts << "ro" if spec[:ro] || spec["ro"] || spec[:readonly] || spec["readonly"]
+        opts << "noexec" if spec[:noexec] || spec["noexec"]
+        opts << "nosuid" if spec[:nosuid] || spec["nosuid"]
+        opts << "nodev" if spec[:nodev] || spec["nodev"]
+        Array(spec[:options] || spec["options"]).each { |o| opts << o.to_s }
+        opts.uniq
+      end
+
       # Normalize a list of patches (each a Hash from the {Patch} factory, or a
       # plain Hash) into string-keyed Hashes for the native layer. Values are
       # passed through unchanged (mode stays Integer, content stays String).

data/lib/microsandbox/version.rb

@@ -5,5 +5,5 @@ module Microsandbox
   # the pinned core-crate tag); the patch segment advances for gem-only revisions
   # that add bindings atop the same core. Must equal the native ext's Cargo crate
   # version (`Native.version`), enforced by spec/unit/version_spec.rb.
-  VERSION = "0.5.10"
+  VERSION = "0.5.11"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: microsandbox-rb
 version: !ruby/object:Gem::Version
-  version: 0.5.10
+  version: 0.5.11
 platform: ruby
 authors:
 - ya-luotao