mxc 0.1.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e26fd36fda75fa52f16b61ca42dd734abae8f53bb5f1f67d7c4535547829585d
-  data.tar.gz: 4f4e49c572372e0571ce7d1d792ac3da2a5d5b92ff7d6621ebf93e70cd77024b
+  metadata.gz: 988895e92e027354db083acc4b7fefd8b48d6ac8a5e4bfed22a734f4c020dd3d
+  data.tar.gz: 4d014ede1e4b3c35551304d1b92fdf49889587b009bb0fb0df39c96fb8718926
 SHA512:
-  metadata.gz: f68d4d670b204c0e24d1200a8cbbd6f4bc9167988d3419e45208c65bd2fa9ee36566d5d3d3ccc0cbeb6ac7b1e805cf4e2f8697ce280bf4bda96f5ab269ea9533
-  data.tar.gz: dab3f9cd45ad45018b857598ca69133ea75f262576a729176036dfef762d5d419133c243da36da96a0cea29e0aa5daea9e165a0ef53448f22834b111a8fdeca2
+  metadata.gz: f9330fd9f89ad26e9ce2494969b6734afb4fdb3f6e4a8f3712421e1d5f28d0e4efbc40965520a6ed3c0211b7ccf2c915fd74b05daed107ef02168e9b4b5f18f1
+  data.tar.gz: 44a17cc95d03e7a24b2fe2cc71fb32137c2983f01c155dbd2a9e1fb0051bd9193e3c22754acdbe050881ec0a3f64f0fcb4b2e131d09c13e4ea02038fc2fa4ed0

data/Cargo.lock

@@ -200,6 +200,26 @@ version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0e9c71c2167ca323c882b99918929403426e2373ea17242ff5653e0d5e1058be"
 
+[[package]]
+name = "enumflags2"
+version = "0.7.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1027f7680c853e056ebcec683615fb6fbbc07dbaa13b4d5d9442b146ded4ecef"
+dependencies = [
+ "enumflags2_derive",
+]
+
+[[package]]
+name = "enumflags2_derive"
+version = "0.7.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67c78a4d8fdf9953a5c9d458f9efe940fd97a0cab0941c075a813ac594733827"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "errno"
 version = "0.3.14"
@@ -456,6 +476,17 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "landlock"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cca98e95f35b29d469dade6724c6f96cec9236640f745a0e99b0334ec320ab1"
+dependencies = [
+ "enumflags2",
+ "libc",
+ "thiserror",
+]
+
 [[package]]
 name = "lazy_static"
 version = "1.5.1"
@@ -562,19 +593,19 @@ dependencies = [
 
 [[package]]
 name = "mxc"
-version = "0.1.0"
+version = "0.3.0"
 dependencies = [
  "magnus",
  "mxc-sdk",
  "rb-sys",
  "rb-sys-env",
+ "serde_json",
 ]
 
 [[package]]
 name = "mxc-sdk"
 version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e4866ca589a68edc8e931eba58eed9253ad1ce670e974aedc4830a1d94bca6cd"
+source = "git+https://github.com/crmne/microsoft-mxc?rev=d57b0d1aa3a2d552001fa54ef4ac4baaa733c26d#d57b0d1aa3a2d552001fa54ef4ac4baaa733c26d"
 dependencies = [
  "anyhow",
  "base64",
@@ -583,6 +614,7 @@ dependencies = [
  "cidr",
  "flatbuffers",
  "getrandom 0.2.17",
+ "landlock",
  "libc",
  "nix",
  "same-file",

data/NOTICE

@@ -5,8 +5,9 @@ This gem is an unofficial Ruby binding to MXC. It is not affiliated with or
 endorsed by Microsoft.
 
 The native extension compiles and links the mxc-sdk crate
-(https://github.com/microsoft/mxc, https://crates.io/crates/mxc-sdk),
-which is distributed under the MIT License:
+(https://github.com/microsoft/mxc, https://crates.io/crates/mxc-sdk), from
+a fork at https://github.com/crmne/microsoft-mxc that adds resource limits
+and a Landlock backend, which is distributed under the MIT License:
 
 MIT License
 

data/README.md

@@ -14,7 +14,7 @@
 
 ---
 
-Your app runs code it did not write: scripts a model generated, skills users uploaded, build steps from someone else. MXC for Ruby runs them in a sandbox that decides what they can read, write, and reach, and how long they get.
+Your app runs code it did not write: scripts a model generated, skills users uploaded, build steps from someone else. MXC for Ruby runs them in a sandbox that decides what they can read, write, and reach, how long they get, and how much CPU and memory they can use.
 
 ```ruby
 result = MXC.run("python3 build.py", readable: "app/skills", writable: "tmp/out", timeout: 30)
@@ -22,7 +22,7 @@ result.stdout
 result.success?
 ```
 
-It is an unofficial Ruby binding to [Microsoft's MXC](https://github.com/microsoft/mxc), the MIT-licensed sandbox library. Not affiliated with or endorsed by Microsoft.
+It is an unofficial Ruby binding to [Microsoft's MXC](https://github.com/microsoft/mxc), the MIT-licensed sandbox library. Not affiliated with or endorsed by Microsoft. Resource limits and the Landlock backend come from [a fork of MXC](https://github.com/crmne/microsoft-mxc) until they are part of MXC itself ([resource limits](https://github.com/microsoft/mxc/issues/1498), [Landlock](https://github.com/microsoft/mxc/issues/1494)).
 
 ## Installation
 
@@ -36,6 +36,8 @@ Precompiled gems cover Linux (x86_64 and ARM64, glibc and musl), macOS (Intel an
 sudo apt-get install bubblewrap
 ```
 
+Where Bubblewrap cannot create its namespaces, as in a default Docker container or on Ubuntu with AppArmor's restriction, sandboxes run on Landlock instead (Linux 6.2 or newer), without network access.
+
 Commands that use the network also need `slirp4netns`, `iptables`, util-linux, and `/dev/net/tun`. macOS and Windows need nothing extra.
 
 ## Usage
@@ -68,6 +70,14 @@ result = sandbox.run("pip download --no-deps -d /tmp/wheels requests")
 result.blocked # => hosts the allow-list refused
 ```
 
+Limit what a command can use, and lower its priority so your app stays responsive:
+
+```ruby
+result = sandbox.with_limits(cpu_time: 2.minutes, memory: 2.gigabytes).with_priority(:low).run("python3 build.py")
+result.cpu_time       # => 3.42
+result.limit_exceeded # => nil, or :cpu_time when it ran out
+```
+
 Stream output as it arrives:
 
 ```ruby
@@ -92,6 +102,7 @@ class SkillSandbox < MXC::Sandbox
   writable "tmp/skills"
   network false
   timeout 30
+  limits cpu_time: 60, memory: 1.gigabyte
 end
 
 SkillSandbox.new.run("python3 app/skills/build.py")
@@ -108,15 +119,16 @@ MXC.backends                   # => [#<MXC::Backend name=:bubblewrap ...>]
 
 ## Platforms
 
-| Platform | Backend | 0.1.0 |
+| Platform | Backend | 0.3.0 |
 | --- | --- | --- |
-| Linux | Bubblewrap | Supported and tested |
-| macOS | Seatbelt | Supported and tested |
+| Linux | Bubblewrap | Supported and tested, without process limits |
+| Linux 6.2 and later | Landlock, where Bubblewrap cannot run or when asked for | Supported and tested, without network access or process limits |
+| macOS | Seatbelt | Supported and tested, without memory or process limits |
 | Windows 11 24H2 and later | ProcessContainer | Supported and tested, without host allow-lists |
 
 On Windows, a single String runs through `cmd.exe` instead of `sh`. See [Running Commands](https://crmne.github.io/mxc/running-commands/#windows) and [Policies](https://crmne.github.io/mxc/policies/#windows) for what else differs.
 
-Docker blocks the namespaces Bubblewrap needs by default. [Running in Docker](https://crmne.github.io/mxc/running-in-docker/) shows the smallest set of changes that makes it work, with a seccomp profile and a Kamal configuration for a job role.
+Docker blocks the namespaces Bubblewrap needs by default, so a default container runs sandboxes on Landlock. [Running in Docker](https://crmne.github.io/mxc/running-in-docker/) shows what that gives up, and the smallest set of changes that makes Bubblewrap work, with a seccomp profile and a Kamal configuration for a job role.
 
 ## Documentation
 

data/ext/mxc/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "mxc"
-version = "0.1.0"
+version = "0.3.0"
 edition = "2021"
 authors = ["Carmine Paolino <carmine@paolino.me>"]
 license = "MIT"
@@ -11,8 +11,11 @@ crate-type = ["cdylib"]
 
 [dependencies]
 magnus = "0.8.2"
-mxc-sdk = "=1.0.0"
+# A fork of mxc-sdk 1.0.0 that adds resource limits (microsoft/mxc#1498) and
+# a Landlock backend (microsoft/mxc#1494), until MXC releases them.
+mxc-sdk = { git = "https://github.com/crmne/microsoft-mxc", rev = "d57b0d1aa3a2d552001fa54ef4ac4baaa733c26d" }
 rb-sys = { version = "0.9.130", features = ["stable-api-compiled-fallback"] }
+serde_json = "1"
 
 [build-dependencies]
 rb-sys-env = "0.2.2"

data/ext/mxc/src/lib.rs

@@ -9,15 +9,27 @@ use magnus::{
 use mxc_sdk::v1::{
     self,
     configs::{ProcessContainerConfig, SeatbeltConfig},
-    Containment, ContainerRequest, FilesystemPolicy, MxcProcess, NetworkAction,
-    NetworkEgressPolicy, NetworkPolicy, NetworkRuntimeConfig, StreamCloser, WaitResult,
+    Containment, ContainerRequest, ExecutionMetadata, FilesystemPolicy, MxcProcess,
+    NetworkAction, NetworkEgressPolicy, NetworkPolicy, NetworkRuntimeConfig, ResourceLimit,
+    StreamCloser, WaitResult,
 };
+use serde_json::{json, Map, Value};
 
 mod proxy;
 
 use proxy::{Allowlist, EgressProxy};
 
 const MAX_POLL: Duration = Duration::from_millis(50);
+/// How long a sandbox that failed may keep its output streams open before
+/// they are closed. Nothing it started runs on, so they end at once.
+const DRAIN: Duration = Duration::from_secs(1);
+
+fn drain_until(drained: impl Fn() -> bool) {
+    let deadline = Instant::now() + DRAIN;
+    while !drained() && Instant::now() < deadline {
+        std::thread::sleep(Duration::from_millis(5));
+    }
+}
 
 fn without_gvl<F, R>(f: F) -> R
 where
@@ -87,6 +99,162 @@ fn deny_all() -> NetworkEgressPolicy {
     }
 }
 
+/// A request ready to start: the typed request, or, when it carries resource
+/// limits or names Landlock, which MXC's typed V1 request cannot express yet,
+/// the same request as `1.1.0-alpha` JSON.
+enum Request {
+    Typed(Box<ContainerRequest>),
+    Json(String),
+}
+
+impl Request {
+    fn spawn(self) -> Result<MxcProcess, v1::Error> {
+        match self {
+            Request::Typed(req) => v1::spawn(*req, Default::default()),
+            Request::Json(json) => mxc_sdk::__ffi::spawn_container_json(&json, false),
+        }
+    }
+}
+
+fn landlock(ruby: &Ruby, opts: RHash) -> Result<bool, Error> {
+    Ok(match opt::<Symbol>(ruby, opts, "backend")? {
+        Some(backend) => backend.name()? == "landlock",
+        None => false,
+    })
+}
+
+fn resources(ruby: &Ruby, opts: RHash) -> Result<Option<Value>, Error> {
+    let Some(limits) = opt::<RHash>(ruby, opts, "resources")? else {
+        return Ok(None);
+    };
+    let mut resources = Map::new();
+    if let Some(ms) = opt::<u64>(ruby, limits, "cpu_time_ms")? {
+        resources.insert("cpuTimeMs".into(), ms.into());
+    }
+    if let Some(mb) = opt::<u64>(ruby, limits, "memory_mb")? {
+        resources.insert("memoryMb".into(), mb.into());
+    }
+    if let Some(count) = opt::<u32>(ruby, limits, "max_processes")? {
+        resources.insert("maxProcesses".into(), count.into());
+    }
+    if let Some(priority) = opt::<String>(ruby, limits, "priority")? {
+        resources.insert("priority".into(), priority.into());
+    }
+    Ok(Some(Value::Object(resources)))
+}
+
+fn action(action: Option<NetworkAction>) -> &'static str {
+    match action {
+        Some(NetworkAction::Allow) => "allow",
+        _ => "deny",
+    }
+}
+
+// Mirrors the 1.0.0 document MXC's typed V1 request produces, plus `resources`
+// and the `landlock` containment.
+fn request_json(
+    ruby: &Ruby,
+    req: &ContainerRequest,
+    resources: Option<Value>,
+    landlock: bool,
+) -> Result<String, Error> {
+    let filesystem = req.filesystem.clone().unwrap_or_default();
+    let mut process = json!({
+        "commandLine": req.command,
+        "timeout": req.timeout_ms.unwrap_or(0),
+    });
+    if let Some(cwd) = &req.working_directory {
+        process["cwd"] = cwd.clone().into();
+    }
+    if let Some(environment) = &req.environment {
+        let env: Vec<String> = environment
+            .iter()
+            .map(|(k, v)| format!("{k}={v}"))
+            .collect();
+        process["env"] = env.into();
+    }
+    let mut document = json!({
+        "version": "1.1.0-alpha",
+        "containerId": mxc_sdk::mxc_common::id::mint_random_token(),
+        "lifecycle": { "destroyOnExit": true, "preservePolicy": false },
+        "process": process,
+        "filesystem": {
+            "readwritePaths": filesystem.readwrite_paths,
+            "readonlyPaths": filesystem.readonly_paths,
+            "deniedPaths": filesystem.denied_paths,
+        },
+    });
+    if let Some(resources) = resources {
+        document["resources"] = resources;
+    }
+    if let Some(network) = &req.network {
+        let default = action(network.egress.as_ref().and_then(|egress| egress.default));
+        document["network"] = json!({ "egress": { "default": default } });
+        if let Some(proxy) = network
+            .runtime_config
+            .as_ref()
+            .and_then(|runtime| runtime.network_proxy.clone())
+        {
+            document["runtimeConfig"] = json!({ "networkProxy": proxy });
+        }
+    }
+    document["containment"] = match &req.containment {
+        _ if landlock => "landlock".into(),
+        Containment::Process => "process".into(),
+        Containment::Bubblewrap => "bubblewrap".into(),
+        Containment::Seatbelt(_) => {
+            document["seatbelt"] = json!({
+                "guiAccess": false,
+                "nestedPty": true,
+                "keychainAccess": false,
+                "extraMachLookups": [],
+            });
+            "seatbelt".into()
+        }
+        Containment::ProcessContainer(_) => {
+            document["processContainer"] = json!({ "leastPrivilege": false, "capabilities": [] });
+            "processcontainer".into()
+        }
+        _ => {
+            return Err(arg_error(
+                ruby,
+                "unsupported backend for resource limits".into(),
+            ))
+        }
+    };
+    Ok(document.to_string())
+}
+
+fn prepare(
+    ruby: &Ruby,
+    command: String,
+    opts: RHash,
+) -> Result<(Request, Option<EgressProxy>), Error> {
+    let (req, egress_proxy) = build_request(ruby, command, opts)?;
+    let landlock = landlock(ruby, opts)?;
+    let request = match resources(ruby, opts)? {
+        None if !landlock => Request::Typed(Box::new(req)),
+        resources => Request::Json(request_json(ruby, &req, resources, landlock)?),
+    };
+    Ok((request, egress_proxy))
+}
+
+fn usage_into(ruby: &Ruby, h: RHash, metadata: Option<&ExecutionMetadata>) -> Result<(), Error> {
+    let usage = metadata.and_then(|metadata| metadata.resource_usage);
+    let cpu_time =
+        usage.map(|usage| (usage.user_cpu_time_us + usage.system_cpu_time_us) as f64 / 1_000_000.0);
+    let limit = usage.and_then(|usage| usage.limit_exceeded).map(|limit| {
+        ruby.to_symbol(match limit {
+            ResourceLimit::CpuTime => "cpu_time",
+            ResourceLimit::Memory => "memory",
+            ResourceLimit::MaxProcesses => "processes",
+        })
+    });
+    h.aset(ruby.to_symbol("cpu_time"), cpu_time)?;
+    h.aset(ruby.to_symbol("limit_exceeded"), limit)?;
+    Ok(())
+}
+
 fn build_request(
     ruby: &Ruby,
     command: String,
@@ -143,6 +311,8 @@ fn build_request(
         req.containment = match backend.name()?.as_ref() {
             "auto" => Containment::Process,
             "bubblewrap" => Containment::Bubblewrap,
+            // The typed request has no Landlock; `request_json` names it.
+            "landlock" => Containment::Process,
             "seatbelt" => Containment::Seatbelt(SeatbeltConfig::default()),
             "process_container" => {
                 Containment::ProcessContainer(ProcessContainerConfig::default())
@@ -153,19 +323,62 @@ fn build_request(
     Ok((req, egress_proxy))
 }
 
-fn outcome_hash(ruby: &Ruby, outcome: WaitResult) -> Result<RHash, Error> {
+// A wait that fails, such as for a sandbox that never started the command,
+// is reported as `failure` rather than raised, so Ruby reads it alongside
+// what the sandbox printed.
+fn outcome_hash(ruby: &Ruby, outcome: std::io::Result<WaitResult>) -> Result<RHash, Error> {
     let h = ruby.hash_new();
-    match outcome {
-        WaitResult::Exited(code) => {
-            h.aset(ruby.to_symbol("timed_out"), false)?;
-            h.aset(ruby.to_symbol("exit_code"), code)?;
+    let (timed_out, exit_code) = match outcome {
+        Ok(WaitResult::Exited(code)) => (false, Some(code)),
+        Ok(WaitResult::TimedOut) => (true, None),
+        Err(e) => {
+            h.aset(ruby.to_symbol("failure"), e.to_string())?;
+            (false, None)
+        }
+    };
+    h.aset(ruby.to_symbol("timed_out"), timed_out)?;
+    h.aset(ruby.to_symbol("exit_code"), exit_code)?;
+    Ok(h)
+}
+
+type Outcome = (std::io::Result<WaitResult>, Vec<String>, Option<ExecutionMetadata>);
+type Drain = std::thread::JoinHandle<std::io::Result<Vec<u8>>>;
+
+fn drain(stream: Option<Box<dyn Read + Send>>) -> Drain {
+    std::thread::spawn(move || {
+        let mut buf = Vec::new();
+        if let Some(mut stream) = stream {
+            stream.read_to_end(&mut buf)?;
         }
-        WaitResult::TimedOut => {
-            h.aset(ruby.to_symbol("timed_out"), true)?;
-            h.aset(ruby.to_symbol("exit_code"), ruby.qnil())?;
+        Ok(buf)
+    })
+}
+
+fn drained(handle: Drain) -> std::io::Result<Vec<u8>> {
+    handle
+        .join()
+        .unwrap_or_else(|_| Err(std::io::Error::other("output capture thread panicked")))
+}
+
+// MXC's `wait_with_output`, except that a failed wait keeps the output: when
+// Bubblewrap cannot set a sandbox up, its reason is on stderr.
+fn capture(mut child: MxcProcess) -> std::io::Result<(Outcome, Vec<u8>, Vec<u8>)> {
+    let closers = [child.stdout_closer(), child.stderr_closer()];
+    let stdout = drain(child.take_stdout());
+    let stderr = drain(child.take_stderr());
+    let outcome = child.wait();
+    let warnings = child.warnings();
+    let metadata = child.output_metadata().cloned();
+    drop(child);
+    if outcome.is_err() {
+        drain_until(|| stdout.is_finished() && stderr.is_finished());
+    }
+    if !matches!(outcome, Ok(WaitResult::Exited(_))) {
+        for closer in closers.iter().flatten() {
+            closer.close();
         }
     }
-    Ok(h)
+    Ok(((outcome, warnings, metadata), drained(stdout)?, drained(stderr)?))
 }
 
 fn snake_case(name: &str) -> String {
@@ -202,18 +415,21 @@ fn backends(ruby: &Ruby) -> Result<RArray, Error> {
 }
 
 fn run(ruby: &Ruby, command: String, opts: RHash) -> Result<RHash, Error> {
-    let (req, mut egress_proxy) = build_request(ruby, command, opts)?;
-    let result = without_gvl(move || v1::run(req, Default::default()));
+    let (req, mut egress_proxy) = prepare(ruby, command, opts)?;
+    let result = without_gvl(move || req.spawn().map(capture));
     let blocked = egress_proxy.as_mut().map(|p| {
         p.stop();
         p.blocked()
     });
-    let r = result.map_err(|e| mxc_error(ruby, e))?;
-    let h = outcome_hash(ruby, r.outcome)?;
-    h.aset(ruby.to_symbol("stdout"), ruby.str_from_slice(&r.stdout))?;
-    h.aset(ruby.to_symbol("stderr"), ruby.str_from_slice(&r.stderr))?;
-    h.aset(ruby.to_symbol("warnings"), r.warnings)?;
+    let ((outcome, warnings, metadata), stdout, stderr) = result
+        .map_err(|e| mxc_error(ruby, e))?
+        .map_err(|e| io_error(ruby, e))?;
+    let h = outcome_hash(ruby, outcome)?;
+    h.aset(ruby.to_symbol("stdout"), ruby.str_from_slice(&stdout))?;
+    h.aset(ruby.to_symbol("stderr"), ruby.str_from_slice(&stderr))?;
+    h.aset(ruby.to_symbol("warnings"), warnings)?;
     h.aset(ruby.to_symbol("blocked"), blocked.unwrap_or_default())?;
+    usage_into(ruby, h, metadata.as_ref())?;
     Ok(h)
 }
 
@@ -233,10 +449,9 @@ struct Process {
 }
 
 fn spawn(ruby: &Ruby, command: String, opts: RHash) -> Result<Process, Error> {
-    let (req, egress_proxy) = build_request(ruby, command, opts)?;
-    let timeout = req.timeout_ms.map(|ms| Duration::from_millis(ms.into()));
-    let mut child = without_gvl(move || v1::spawn(req, Default::default()))
-        .map_err(|e| mxc_error(ruby, e))?;
+    let timeout = opt::<u32>(ruby, opts, "timeout_ms")?.map(|ms| Duration::from_millis(ms.into()));
+    let (req, egress_proxy) = prepare(ruby, command, opts)?;
+    let mut child = without_gvl(move || req.spawn()).map_err(|e| mxc_error(ruby, e))?;
     Ok(Process {
         pid: child.id(),
         deadline: timeout.map(|t| Instant::now() + t),
@@ -278,6 +493,21 @@ impl Process {
         self.pid
     }
 
+    fn warnings(&self) -> Vec<String> {
+        match self.child.lock().unwrap().as_ref() {
+            Some(child) => child.warnings(),
+            None => Vec::new(),
+        }
+    }
+
+    // A reader blocked in `read` holds its stream's lock, and one that reached
+    // the end leaves `None`.
+    fn drained(&self) -> bool {
+        [&self.stdout, &self.stderr]
+            .iter()
+            .all(|stream| matches!(stream.try_lock(), Ok(guard) if guard.is_none()))
+    }
+
     fn read_stdout(ruby: &Ruby, rb_self: &Self, max: usize) -> Result<Option<RString>, Error> {
         read_from(ruby, &rb_self.stdout, max)
     }
@@ -315,7 +545,7 @@ impl Process {
 
     // MxcProcess::kill and ::wait both need the handle exclusively, so waiting
     // polls and releases the lock between polls to let kill in.
-    fn await_exit(&self) -> std::io::Result<(WaitResult, Vec<String>)> {
+    fn await_exit(&self) -> std::io::Result<Outcome> {
         let mut nap = Duration::from_millis(1);
         loop {
             {
@@ -324,11 +554,12 @@ impl Process {
                     .as_mut()
                     .ok_or_else(|| std::io::Error::other("the process was already waited for"))?;
                 let expired = self.deadline.is_some_and(|d| Instant::now() >= d);
-                if expired || child.try_wait()?.is_some() {
-                    let outcome = child.wait()?;
+                if expired || !matches!(child.try_wait(), Ok(None)) {
+                    let outcome = child.wait();
                     let warnings = child.warnings();
+                    let metadata = child.output_metadata().cloned();
                     guard.take();
-                    return Ok((outcome, warnings));
+                    return Ok((outcome, warnings, metadata));
                 }
             }
             let mut sleep = nap;
@@ -349,8 +580,11 @@ impl Process {
             }
             None => Vec::new(),
         };
-        let (outcome, warnings) = res.map_err(|e| io_error(ruby, e))?;
-        if !matches!(outcome, WaitResult::Exited(_)) {
+        let (outcome, warnings, metadata) = res.map_err(|e| io_error(ruby, e))?;
+        if outcome.is_err() {
+            without_gvl(|| drain_until(|| rb_self.drained()));
+        }
+        if !matches!(outcome, Ok(WaitResult::Exited(_))) {
             if let Some(c) = &rb_self.stdout_closer {
                 c.close();
             }
@@ -361,6 +595,7 @@ impl Process {
         let h = outcome_hash(ruby, outcome)?;
         h.aset(ruby.to_symbol("warnings"), warnings)?;
         h.aset(ruby.to_symbol("blocked"), blocked)?;
+        usage_into(ruby, h, metadata.as_ref())?;
         Ok(h)
     }
 }
@@ -374,6 +609,7 @@ fn init(ruby: &Ruby) -> Result<(), Error> {
     native.define_singleton_method("spawn", function!(spawn, 2))?;
     let process = native.define_class("Process", ruby.class_object())?;
     process.define_method("pid", method!(Process::pid, 0))?;
+    process.define_method("warnings", method!(Process::warnings, 0))?;
     process.define_method("read_stdout", method!(Process::read_stdout, 1))?;
     process.define_method("read_stderr", method!(Process::read_stderr, 1))?;
     process.define_method("write", method!(Process::write, 1))?;

data/lib/mxc/availability.rb

@@ -16,9 +16,13 @@ module MXC
     # Returns a suggestion for making the host supported, or nil.
     attr_reader :remediation
 
+    # Returns the backend sandboxes run on, such as <tt>:bubblewrap</tt>, or <tt>:landlock</tt>
+    # when <tt>:auto</tt> falls back to it. Returns nil when no sandbox can start.
+    attr_reader :runs_on
+
     def self.probe(backend) # :nodoc:
       result = Sandbox.new(backend:, timeout: 10).run('exit 0')
-      return new(backend:, supported: true) if result.success?
+      return new(backend:, supported: true, runs_on: result.backend) if result.success?
 
       outcome = result.timed_out? ? 'timed out' : "exited with #{result.exit_code}"
       new(backend:, supported: false, reason: "A sandboxed `exit 0` #{outcome}: #{result.stderr.strip}")
@@ -26,8 +30,9 @@ module MXC
       new(backend:, supported: false, reason: e.message, remediation: e.remediation)
     end
 
-    def initialize(backend:, supported:, reason: nil, remediation: nil) # :nodoc:
+    def initialize(backend:, supported:, reason: nil, remediation: nil, runs_on: nil) # :nodoc:
       @backend = backend
+      @runs_on = runs_on
       @supported = supported
       @reason = reason
       @remediation = remediation
@@ -39,7 +44,8 @@ module MXC
     end
 
     def inspect # :nodoc:
-      "#<MXC::Availability backend=#{backend.inspect} supported=#{supported?} reason=#{reason.inspect}>"
+      "#<MXC::Availability backend=#{backend.inspect} supported=#{supported?} runs_on=#{runs_on.inspect} " \
+        "reason=#{reason.inspect}>"
     end
   end
 end

data/lib/mxc/configuration.rb

@@ -15,7 +15,8 @@ module MXC
       @timeout = nil
     end
 
-    # Sets the default backend: <tt>:auto</tt>, <tt>:bubblewrap</tt>, or <tt>:seatbelt</tt>.
+    # Sets the default backend: <tt>:auto</tt>, <tt>:bubblewrap</tt>, <tt>:landlock</tt>,
+    # <tt>:seatbelt</tt>, or <tt>:process_container</tt>.
     def backend=(name)
       @backend = Sandbox.backend_name(name)
     end

data/lib/mxc/native.rb

@@ -13,6 +13,9 @@ module MXC
     MISSING_BUBBLEWRAP = /bwrap\) is not installed/
     INSTALL_BUBBLEWRAP = 'Install Bubblewrap 0.5.0 or newer (Debian/Ubuntu: apt-get install bubblewrap; ' \
                          'Fedora: dnf install bubblewrap; Arch: pacman -S bubblewrap)'
+    LANDLOCK_REFUSAL = /\ALandlock: /
+    LANDLOCK_POLICY = 'Change the policy as the message says, or run on Bubblewrap: a sandbox with backend :auto ' \
+                      'runs on Landlock only where Bubblewrap cannot create its namespaces'
 
     def self.backend_attributes
       backends.map { |attributes| attributes.merge(name: BACKEND_NAMES.fetch(attributes[:name], attributes[:name])) }
@@ -21,8 +24,12 @@ module MXC
     def self.error(message, code: nil, remediation: nil, **)
       if message.match?(MISSING_BUBBLEWRAP)
         UnsupportedError.new(message, code: :backend_unavailable, remediation: remediation || INSTALL_BUBBLEWRAP, **)
+      elsif message.match?(LANDLOCK_REFUSAL)
+        UnsupportedError.new(message, code:, remediation: remediation || LANDLOCK_POLICY, **)
+      elsif UNSUPPORTED_CODES.include?(code)
+        UnsupportedError.new(message, code:, remediation: remediation || StartupFailure.hint(message), **)
       else
-        (UNSUPPORTED_CODES.include?(code) ? UnsupportedError : Error).new(message, code:, remediation:, **)
+        Error.new(message, code:, remediation:, **)
       end
     end
   end

data/lib/mxc/preflight.rb

@@ -12,15 +12,46 @@ module MXC
                          'a sandbox to a proxy only by also accepting inbound connections to it'
     WINDOWS_DENIED = 'Leave the paths out of readable and writable instead, or run on a Windows build where ' \
                      'MXC.supports?(:filesystem_denied_paths) is true'
+    MACOS_MEMORY = 'Leave memory out of the limits on macOS, which rejects memory rlimits. ' \
+                   'Linux and Windows support it'
+    PROCESS_LIMIT = 'Leave processes out of the limits. Only Windows can count the processes of one sandbox; ' \
+                    'in a container, limit them with docker run --pids-limit'
+    LANDLOCK_NETWORK = 'Use network: false, or the :bubblewrap backend on a host that allows unprivileged user ' \
+                       'namespaces. Landlock cannot tell one address from another, so it could only allow the ' \
+                       "whole host network, the host's loopback and inbound connections included"
 
     module_function
 
-    def check!(network:, denied: [])
-      error = problem(network:, denied:)
+    def check!(network:, denied: [], resources: nil, backend: :auto)
+      error = problem(network:, denied:, resources:, backend:)
       raise error if error
     end
 
-    def problem(network:, denied: [], path: ENV.fetch('PATH', ''), tun: TUN)
+    def problem(network:, denied: [], resources: nil, backend: :auto, path: ENV.fetch('PATH', ''), tun: TUN)
+      resource_problem(resources) || landlock_problem(network, backend) || host_problem(network, denied, path, tun)
+    end
+
+    def landlock_problem(network, backend)
+      return unless network && backend == :landlock
+
+      kind = network.is_a?(Hash) ? 'Host allow-lists are' : 'Network access is'
+      UnsupportedError.new("#{kind} not supported on Landlock", code: :backend_unavailable,
+                                                                remediation: LANDLOCK_NETWORK)
+    end
+
+    def resource_problem(resources)
+      return if resources.nil? || windows?
+
+      if resources[:max_processes]
+        UnsupportedError.new("Process limits are not supported on #{linux? ? 'Linux' : 'macOS'}",
+                             code: :backend_unavailable, remediation: PROCESS_LIMIT)
+      elsif resources[:memory_mb] && !linux?
+        UnsupportedError.new('Memory limits are not supported on macOS',
+                             code: :backend_unavailable, remediation: MACOS_MEMORY)
+      end
+    end
+
+    def host_problem(network, denied, path, tun)
       return windows_problem(network, denied) if windows?
       return unless network && linux?
 

data/lib/mxc/result.rb

@@ -25,7 +25,18 @@ module MXC
     # Returns the backend that ran the command, such as <tt>:bubblewrap</tt>.
     attr_reader :backend
 
-    def initialize(stdout:, stderr:, exit_code:, timed_out:, warnings:, blocked:, backend:) # :nodoc:
+    # Returns the CPU time the command used, user and system, in seconds as a Float. It
+    # includes every process the command started and waited for. Returns nil unless the
+    # sandbox has limits or a priority.
+    attr_reader :cpu_time
+
+    # Returns the limit the command ran into: <tt>:cpu_time</tt>, <tt>:memory</tt>,
+    # <tt>:processes</tt>, or nil. Linux and macOS report <tt>:cpu_time</tt> only, because a
+    # program that cannot allocate memory decides itself how to fail.
+    attr_reader :limit_exceeded
+
+    def initialize(stdout:, stderr:, exit_code:, timed_out:, warnings:, blocked:, backend:, # :nodoc:
+                   cpu_time: nil, limit_exceeded: nil)
       @stdout = text(stdout)
       @stderr = text(stderr)
       @exit_code = exit_code
@@ -33,6 +44,8 @@ module MXC
       @warnings = warnings.freeze
       @blocked = blocked.freeze
       @backend = backend
+      @cpu_time = cpu_time
+      @limit_exceeded = limit_exceeded
     end
 
     # Returns true when the command exited with status 0 before its timeout.
@@ -47,11 +60,13 @@ module MXC
 
     # Returns the result as a Hash.
     def to_h
-      { stdout:, stderr:, exit_code:, timed_out: timed_out?, warnings:, blocked:, backend: }
+      { stdout:, stderr:, exit_code:, timed_out: timed_out?, warnings:, blocked:, backend:, cpu_time:,
+        limit_exceeded: }
     end
 
     def inspect # :nodoc:
-      "#<MXC::Result exit_code=#{exit_code.inspect} timed_out=#{timed_out?} backend=#{backend.inspect}>"
+      usage = " cpu_time=#{cpu_time.round(3)} limit_exceeded=#{limit_exceeded.inspect}" if cpu_time
+      "#<MXC::Result exit_code=#{exit_code.inspect} timed_out=#{timed_out?}#{usage} backend=#{backend.inspect}>"
     end
 
     private

data/lib/mxc/sandbox.rb

@@ -22,19 +22,26 @@ module MXC
   #     writable "tmp/skills"
   #     network false
   #     timeout 30
+  #     limits cpu_time: 60, memory: 2 * 1024**3
+  #     priority :low
   #   end
   #
   #   SkillSandbox.new.run("python3 app/skills/build.py")
   class Sandbox
-    BACKENDS = %i[auto bubblewrap seatbelt process_container].freeze # :nodoc:
-    OPTIONS = %i[readable writable denied network env directory timeout backend].freeze # :nodoc:
+    BACKENDS = %i[auto bubblewrap landlock seatbelt process_container].freeze # :nodoc:
+    LANDLOCK_FALLBACK = /runs on Landlock instead/ # :nodoc:
+    OPTIONS = %i[readable writable denied network env directory timeout backend limits priority].freeze # :nodoc:
     HOST_RESOLVER_SOCKETS = %w[/run/systemd/resolve].freeze # :nodoc:
     WINDOWS_ENV = %w[SYSTEMROOT WINDIR SYSTEMDRIVE COMSPEC PATHEXT PATH LOCALAPPDATA TEMP TMP
                      PROCESSOR_ARCHITECTURE NUMBER_OF_PROCESSORS OS].freeze # :nodoc:
     BATCH_FILE = /\.(bat|cmd)\z/i # :nodoc:
     MAX_TIMEOUT_MS = (2**32) - 1 # :nodoc:
+    LIMITS = %i[cpu_time memory processes].freeze # :nodoc:
+    PRIORITIES = { normal: nil, low: 'low', lowest: 'idle' }.freeze # :nodoc:
+    MEGABYTE = 1024 * 1024 # :nodoc:
     DEFAULTS = {
-      readable: [], writable: [], denied: [], env: {}, network: false, directory: nil, timeout: nil, backend: nil
+      readable: [], writable: [], denied: [], env: {}, network: false, directory: nil, timeout: nil, backend: nil,
+      limits: {}, priority: nil
     }.freeze # :nodoc:
 
     class << self
@@ -62,6 +69,12 @@ module MXC
       # Sets every instance's backend.
       def backend(name) = configure { |sandbox| sandbox.with_backend(name) }
 
+      # Sets every instance's resource limits. Takes the same arguments as #with_limits.
+      def limits(...) = configure { |sandbox| sandbox.with_limits(...) }
+
+      # Sets every instance's scheduling priority: <tt>:normal</tt>, <tt>:low</tt>, or <tt>:lowest</tt>.
+      def priority(level) = configure { |sandbox| sandbox.with_priority(level) }
+
       def defaults # :nodoc:
         @defaults ||= allocate.tap { |sandbox| sandbox.send(:inherit, self == Sandbox ? nil : superclass.defaults) }
       end
@@ -95,9 +108,11 @@ module MXC
 
     # Returns a new sandbox with the class's defaults, then applies +options+ through
     # the matching setters: <tt>readable:</tt>, <tt>writable:</tt>, <tt>denied:</tt>,
-    # <tt>network:</tt>, <tt>env:</tt>, <tt>directory:</tt>, <tt>timeout:</tt> and <tt>backend:</tt>.
+    # <tt>network:</tt>, <tt>env:</tt>, <tt>directory:</tt>, <tt>timeout:</tt>, <tt>backend:</tt>,
+    # <tt>limits:</tt> and <tt>priority:</tt>.
     #
     #   MXC::Sandbox.new(readable: "app/skills", network: { allow: ["pypi.org"] }, timeout: 30)
+    #   MXC::Sandbox.new(limits: { cpu_time: 60, memory: 2 * 1024**3 }, priority: :low)
     def initialize(**options)
       unknown = options.keys - OPTIONS
       raise ArgumentError, "unknown option#{'s' if unknown.size > 1}: #{unknown.join(', ')}" if unknown.any?
@@ -135,6 +150,13 @@ module MXC
     # Returns the backend, falling back to MXC.config.backend.
     def backend = @settings[:backend] || MXC.config.backend
 
+    # Returns the resource limits, such as <tt>{ cpu_time: 60, memory: 2147483648 }</tt>.
+    # A limit that is not set is absent.
+    def limits = @settings[:limits].dup.freeze
+
+    # Returns the scheduling priority: <tt>:normal</tt>, <tt>:low</tt>, or <tt>:lowest</tt>.
+    def priority = @settings[:priority] || :normal
+
     # Adds paths the command can read. Accepts Strings and Pathnames; relative paths
     # are expanded from the current directory when the command runs.
     def with_readable(*paths)
@@ -197,13 +219,53 @@ module MXC
     end
 
     # Sets the backend: <tt>:auto</tt> (Bubblewrap on Linux, Seatbelt on macOS,
-    # ProcessContainer on Windows), <tt>:bubblewrap</tt>, <tt>:seatbelt</tt>, or
-    # <tt>:process_container</tt>.
+    # ProcessContainer on Windows), <tt>:bubblewrap</tt>, <tt>:landlock</tt>, <tt>:seatbelt</tt>,
+    # or <tt>:process_container</tt>.
+    #
+    # On Linux, <tt>:auto</tt> runs on Landlock when Bubblewrap cannot create its namespaces,
+    # and says so in Result#warnings. <tt>:bubblewrap</tt> never does. <tt>:landlock</tt>
+    # needs Linux 6.2 or newer and runs without network access.
     def with_backend(name)
       @settings[:backend] = name && self.class.backend_name(name)
       self
     end
 
+    # Sets resource limits. Each process the command starts gets its own CPU time and memory.
+    #
+    # <tt>cpu_time:</tt> is the CPU time each process may use, in seconds. It accepts
+    # anything that responds to +to_f+, such as <tt>90</tt> or <tt>2.minutes</tt>, and is
+    # rounded up to whole seconds on Linux and macOS. A process that uses it up is stopped.
+    #
+    # <tt>memory:</tt> is the memory each process may allocate, in bytes. It accepts
+    # anything that responds to +to_i+, such as <tt>2 * 1024**3</tt> or
+    # <tt>2.gigabytes</tt>, and is rounded up to whole megabytes. Allocations beyond it
+    # fail. Not available on macOS.
+    #
+    # <tt>processes:</tt> is how many processes the command may run at the same time.
+    # Windows only.
+    #
+    # A limit given as +nil+ is removed, and <tt>with_limits(nil)</tt> removes them all.
+    # Raises ArgumentError for an unknown limit or a value that is not positive.
+    #
+    #   sandbox.with_limits(cpu_time: 2.minutes, memory: 2.gigabytes)
+    def with_limits(reset = (keep = true), **limits)
+      unless keep
+        raise ArgumentError, "pass limits as keywords, or nil to remove them, got #{reset.inspect}" unless reset.nil?
+
+        @settings[:limits].clear
+      end
+      limits.each { |name, value| set_limit(name, value) }
+      self
+    end
+
+    # Sets the scheduling priority of every process the command starts: <tt>:normal</tt>
+    # (the default), <tt>:low</tt> (nice 10 on Linux and macOS, below normal on
+    # Windows), or <tt>:lowest</tt> (nice 19, or idle on Windows).
+    def with_priority(level)
+      @settings[:priority] = level && priority_name(level)
+      self
+    end
+
     # Runs +command+ and returns its Result once it finishes. Like Kernel#system, one
     # String runs through the platform shell: <tt>sh -c</tt>, or <tt>cmd.exe /d /s /c</tt>
     # on Windows. Two or more Strings are a program and its arguments, and each argument
@@ -222,7 +284,7 @@ module MXC
       return stream(*command, &) if block_given?
 
       outcome = StartupFailure.check!(Native.run(command_line(command), request))
-      Result.new(**outcome, backend: resolved_backend)
+      Result.new(**outcome, backend: resolved_backend(outcome[:warnings]))
     end
 
     # Starts +command+ and returns its Process without waiting for it. Takes the command
@@ -230,7 +292,8 @@ module MXC
     #
     #   sandbox.spawn("python3", "-i", "-q")
     def spawn(*command)
-      Process.new(Native.spawn(command_line(command), request), backend: resolved_backend)
+      native = Native.spawn(command_line(command), request)
+      Process.new(native, backend: resolved_backend(native.warnings))
     end
 
     # Returns true when this host can run this sandbox, including its network policy.
@@ -241,15 +304,18 @@ module MXC
     # Returns the Availability of this sandbox on this host, with the reason and
     # remediation when it cannot run.
     def availability
-      problem = Preflight.problem(network:, denied:)
-      return MXC.availability(backend:) unless problem
+      problem = Preflight.problem(network:, denied:, resources:, backend:)
+      host = MXC.availability(backend:) unless problem
+      problem ||= Preflight.problem(network:, backend: :landlock) if host&.runs_on == :landlock
+      return host unless problem
 
       Availability.new(backend:, supported: false, reason: problem.message, remediation: problem.remediation)
     end
 
     def inspect # :nodoc:
+      resources = " limits=#{limits.inspect} priority=#{priority.inspect}" if self.resources
       "#<#{self.class.name || 'MXC::Sandbox'} backend=#{backend.inspect} network=#{network.inspect} " \
-        "readable=#{readable.inspect} writable=#{writable.inspect} timeout=#{timeout.inspect}>"
+        "readable=#{readable.inspect} writable=#{writable.inspect} timeout=#{timeout.inspect}#{resources}>"
     end
 
     protected
@@ -266,10 +332,42 @@ module MXC
       case name
       when :readable, :writable, :denied then public_send(:"with_#{name}", *Array(value))
       when :network then value.is_a?(Hash) ? with_network(**value) : with_network(value)
+      when :limits then value.nil? ? with_limits(nil) : with_limits(**value)
       else public_send(:"with_#{name}", value)
       end
     end
 
+    def set_limit(name, value)
+      unless LIMITS.include?(name)
+        raise ArgumentError, "unknown limit #{name.inspect}, expected one of #{LIMITS.map(&:inspect).join(', ')}"
+      end
+      return @settings[:limits].delete(name) if value.nil?
+
+      @settings[:limits][name] = positive_limit(name, value)
+    end
+
+    def positive_limit(name, value)
+      amount = limit_amount(name, value)
+      raise ArgumentError, "#{name} must be a positive number, got #{value.inspect}" unless amount&.positive?
+
+      value
+    end
+
+    def limit_amount(name, value)
+      return (value if value.is_a?(Integer)) if name == :processes
+
+      conversion = name == :cpu_time ? :to_f : :to_i
+      value.public_send(conversion) if value.respond_to?(conversion)
+    end
+
+    def priority_name(level)
+      level = level.to_sym
+      return level if PRIORITIES.key?(level)
+
+      raise ArgumentError,
+            "unknown priority #{level.inspect}, expected one of #{PRIORITIES.keys.map(&:inspect).join(', ')}"
+    end
+
     def add_paths(name, paths)
       list = @settings[name]
       paths == [nil] ? list.clear : list.concat(paths.flatten.map { |path| File.path(path) })
@@ -314,15 +412,16 @@ module MXC
       arguments.map { |argument| WindowsArguments.quote(argument) }.join(' ')
     end
 
-    def resolved_backend
+    def resolved_backend(warnings)
       return backend unless backend == :auto
       return :process_container if Preflight.windows?
+      return :seatbelt unless Preflight.linux?
 
-      Preflight.linux? ? :bubblewrap : :seatbelt
+      warnings.any?(LANDLOCK_FALLBACK) ? :landlock : :bubblewrap
     end
 
     def request
-      Preflight.check!(network:, denied:)
+      Preflight.check!(network:, denied:, resources:, backend:)
       {
         readonly: expand(readable),
         readwrite: expand(writable),
@@ -332,10 +431,28 @@ module MXC
         timeout_ms: timeout && [(timeout.to_f * 1000).ceil, MAX_TIMEOUT_MS].min,
         backend:,
         network: network == true,
-        allow: network.is_a?(Hash) ? network[:allow] : nil
+        allow: network.is_a?(Hash) ? network[:allow] : nil,
+        resources:
       }
     end
 
+    protected
+
+    # The resource limits as MXC takes them, or nil when there are none.
+    def resources
+      limits = @settings[:limits]
+      return if limits.empty? && priority == :normal
+
+      {
+        cpu_time_ms: limits[:cpu_time] && (limits[:cpu_time].to_f * 1000).ceil,
+        memory_mb: limits[:memory] && -(-limits[:memory].to_i / MEGABYTE),
+        max_processes: limits[:processes],
+        priority: PRIORITIES.fetch(priority)
+      }.compact
+    end
+
+    private
+
     def expand(paths)
       paths.map { |path| native_path(File.expand_path(path)) }
     end

data/lib/mxc/startup_failure.rb

@@ -7,7 +7,8 @@ module MXC
                               /setting up uid map/i, /unshare.*Operation not permitted/i)
     PROC = /Can't mount proc|mount proc on/i
     HOST_PROBLEMS = {
-      NAMESPACES => 'Unprivileged user namespaces are blocked. On a host, enable kernel.unprivileged_userns_clone=1 ' \
+      NAMESPACES => 'Unprivileged user namespaces are blocked. Use backend :auto or :landlock to run on Landlock ' \
+                    'instead, or allow them for Bubblewrap: on a host, enable kernel.unprivileged_userns_clone=1 ' \
                     'and, on Ubuntu 23.10 and later, allow bwrap in AppArmor ' \
                     '(kernel.apparmor_restrict_unprivileged_userns). ' \
                     "In Docker, run with a seccomp profile that allows namespaces: #{DOCKER_GUIDE}",
@@ -15,23 +16,27 @@ module MXC
               "In Docker, see #{DOCKER_GUIDE}"
     }.freeze
     CHDIR = /Can't chdir/i
+    BWRAP_LINE = /^bwrap: .*$/
 
     module_function
 
     def detect(outcome)
-      return unless outcome[:exit_code] == 1 && outcome[:stdout].to_s.empty?
+      failure = outcome[:failure] or return
+      reason = outcome[:stderr].to_s.scan(BWRAP_LINE).last
+      return Error.new(failure, code: :backend_error) unless reason
 
-      stderr = outcome[:stderr].to_s
-      return unless stderr.match?(/\Abwrap: [^\n]*\n?\z/)
-
-      message = "Bubblewrap could not start the sandbox: #{stderr.strip}"
-      _, hint = HOST_PROBLEMS.find { |pattern, _| stderr.match?(pattern) }
+      message = "Bubblewrap could not start the sandbox: #{reason}"
+      hint = hint(reason)
       return UnsupportedError.new(message, code: :backend_unavailable, remediation: hint, operation: 'bwrap') if hint
 
-      remediation = 'Make the directory readable or writable in the sandbox' if stderr.match?(CHDIR)
+      remediation = 'Make the directory readable or writable in the sandbox' if reason.match?(CHDIR)
       Error.new(message, code: :backend_error, remediation:, operation: 'bwrap')
     end
 
+    def hint(message)
+      HOST_PROBLEMS.find { |pattern, _| message.match?(pattern) }&.last
+    end
+
     def check!(outcome)
       error = detect(outcome)
       raise error if error

data/lib/mxc/version.rb

@@ -2,5 +2,5 @@
 
 module MXC
   # The gem version.
-  VERSION = '0.1.0'
+  VERSION = '0.3.0'
 end

data/lib/mxc.rb

@@ -19,6 +19,11 @@ require 'mxc/sandbox'
 #   result = MXC.run("python3 build.py", readable: "app/skills", writable: "tmp/out", timeout: 30)
 #   result.stdout
 module MXC
+  RESOURCE_CAPABILITIES = {
+    cpu_time_limit: { cpu_time_ms: 1 }, memory_limit: { memory_mb: 1 },
+    process_limit: { max_processes: 1 }, priority: { priority: 'low' }
+  }.freeze # :nodoc:
+
   @availability = {}
   @availability_lock = Mutex.new
 
@@ -82,22 +87,33 @@ module MXC
       Native.backend_attributes.map { |attributes| Backend.new(**attributes) }
     end
 
-    # Returns true when this host supports +capability+ with the configured backend.
+    # Returns true when this host supports +capability+ with the configured backend. Where
+    # sandboxes run on Landlock, there is no <tt>:network</tt> or <tt>:network_policy</tt>.
     #
     # +capability+ is <tt>:network</tt> for unrestricted network access,
-    # <tt>:network_policy</tt> for host allow-lists, or any capability a Backend reports.
+    # <tt>:network_policy</tt> for host allow-lists, <tt>:cpu_time_limit</tt>,
+    # <tt>:memory_limit</tt>, <tt>:process_limit</tt> and <tt>:priority</tt> for the
+    # matching Sandbox#with_limits and Sandbox#with_priority settings, or any capability a
+    # Backend reports.
+    #
+    #   MXC.supports?(:memory_limit) # => false on macOS
     def supports?(capability)
       return false unless supported?
 
       case capability
-      when :network then Preflight.problem(network: true).nil?
-      when :network_policy then Preflight.problem(network: { allow: [] }).nil? && proxy_enforcement?
+      when :network then Preflight.problem(network: true, backend: runs_on).nil?
+      when :network_policy then Preflight.problem(network: { allow: [] }, backend: runs_on).nil? && proxy_enforcement?
+      when *RESOURCE_CAPABILITIES.keys then Preflight.resource_problem(RESOURCE_CAPABILITIES[capability]).nil?
       else configured_backends.any? { |backend| backend.supports?(capability) }
       end
     end
 
     private
 
+    def runs_on
+      availability.runs_on
+    end
+
     def proxy_enforcement?
       !Preflight.linux? || configured_backends.any? { |backend| backend.supports?(:proxy_enforcement) }
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mxc
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Carmine Paolino