@namzu/sandbox 4.0.0 → 6.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +86 -0
- package/README.md +513 -238
- package/dist/backends/aci-standby-pool/index.d.ts.map +1 -1
- package/dist/backends/aci-standby-pool/index.js +2 -1
- package/dist/backends/aci-standby-pool/index.js.map +1 -1
- package/dist/backends/docker/index.d.ts +50 -4
- package/dist/backends/docker/index.d.ts.map +1 -1
- package/dist/backends/docker/index.js +130 -8
- package/dist/backends/docker/index.js.map +1 -1
- package/dist/backends/firecracker/index.d.ts.map +1 -1
- package/dist/backends/firecracker/index.js +7 -0
- package/dist/backends/firecracker/index.js.map +1 -1
- package/dist/index.d.ts +13 -5
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js.map +1 -1
- package/package.json +4 -4
- package/src/backends/aci-standby-pool/index.ts +2 -1
- package/src/backends/docker/index.ts +147 -7
- package/src/backends/firecracker/index.ts +7 -0
- package/src/index.ts +13 -5
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AASH,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAA;AACjF,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AAazE,qEAAqE;AACrE,2DAA2D;AAC3D,iEAAiE;AACjE,6DAA6D;AAC7D,oEAAoE;AACpE,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,4BAA4B,GAC5B,MAAM,YAAY,CAAA;AAUnB,OAAO,EAGN,mBAAmB,GACnB,MAAM,qCAAqC,CAAA;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AASH,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAA;AACjF,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AAazE,qEAAqE;AACrE,2DAA2D;AAC3D,iEAAiE;AACjE,6DAA6D;AAC7D,oEAAoE;AACpE,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,4BAA4B,GAC5B,MAAM,YAAY,CAAA;AAUnB,OAAO,EAGN,mBAAmB,GACnB,MAAM,qCAAqC,CAAA;AAqR5C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACN,WAAW,EACX,aAAa,EACb,cAAc,GACd,MAAM,mBAAmB,CAAA;AAmH1B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA6B;IAClE,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IACnC,MAAM,EAAE,GAAG,SAAS,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAA;IAClD,MAAM,IAAI,GAAG,mBAAmB,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAA;IACjE,OAAO;QACN,EAAE;QACF,IAAI;QACJ,WAAW,EAAE,OAAO;QACpB,KAAK,CAAC,MAAM,CAAC,OAA6B;YACzC,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC;gBAC3B,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,IAAI,YAAY;gBAC3D,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/E,GAAG,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS;oBACnC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;oBAClC,CAAC,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS;wBACtC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,gBAAgB,EAAE;wBACxC,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,EAAE,aAAa,KAAK,SAAS;oBACvC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE;oBAC1C,CAAC,CAAC,MAAM,CAAC,oBAAoB,KAAK,SAAS;wBAC1C,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,oBAAoB,EAAE;wBAChD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,EAAE,YAAY,KAAK,SAAS;oBACtC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;oBACxC,CAAC,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS;wBACzC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,mBAAmB,EAAE;wBAC9C,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D,CAAC,CAAA;QACH,CAAC;KACD,CAAA;AACF,CAAC;AAED,SAAS,WAAW,CAAC,MAA6B;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;IAC9B,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChF,0DAA0D;QAC1D,yDAAyD;QACzD,aAAa;QACb,MAAM,MAAM,GAAI,MAA6E;aAC3F,MAAM,CAAA;QACR,gEAAgE;QAChE,6DAA6D;QAC7D,mDAAmD;QACnD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;QACtC,OAAO,kBAAkB,CAAC;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,QAAQ;YAChB,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC,CAAA;IACH,CAAC;IACD,IACC,OAAO,CAAC,IAAI,KAAK,WAAW;QAC3B,OAA2C,CAAC,OAAO,KAAK,kBAAkB,EAC1E,CAAC;QACF,MAAM,UAAU,GAAG,OAAiD,CAAA;QACpE,MAAM,MAAM,GAAI,MAA6E;aAC3F,MAAM,CAAA;QACR,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;QACtC,OAAO,0BAA0B,CAAC;YACjC,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,qBAAqB,EAAE,UAAU,CAAC,qBAAqB;YACvD,+BAA+B,EAAE,UAAU,CAAC,+BAA+B;YAC3E,GAAG,CAAC,UAAU,CAAC,6BAA6B,KAAK,SAAS;gBACzD,CAAC,CAAC,EAAE,6BAA6B,EAAE,UAAU,CAAC,6BAA6B,EAAE;gBAC7E,CAAC,CAAC,EAAE,CAAC;YACN,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,GAAG,CAAC,UAAU,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,UAAU,CAAC,mBAAmB,KAAK,SAAS;gBAC/C,CAAC,CAAC,EAAE,mBAAmB,EAAE,UAAU,CAAC,mBAAmB,EAAE;gBACzD,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,UAAU,CAAC,cAAc,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE;gBAC/C,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,UAAU,CAAC,aAAa,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,UAAU,CAAC,mBAAmB,KAAK,SAAS;gBAC/C,CAAC,CAAC,EAAE,mBAAmB,EAAE,UAAU,CAAC,mBAAmB,EAAE;gBACzD,CAAC,CAAC,EAAE,CAAC;SACN,CAAC,CAAA;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACjE,MAAM,MAAM,GAAI,MAA6E;aAC3F,MAAM,CAAA;QACR,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;QACtC,OAAO,kBAAkB,CAAC;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,OAAO;YAChB,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC,CAAA;IACH,CAAC;IACD,8DAA8D;IAC9D,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,oEAAoE;IACpE,6DAA6D;IAC7D,IACC,OAAO,CAAC,IAAI,KAAK,SAAS;QAC1B,OAAO,CAAC,OAAO,KAAK,aAAa;QACjC,OAAO,CAAC,oBAAoB,KAAK,SAAS;QAC1C,OAAO,CAAC,QAAQ,KAAK,SAAS,EAC7B,CAAC;QACF,OAAO,uBAAuB,CAAC;YAC9B,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;YAClD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,OAAO,CAAC,mBAAmB,KAAK,SAAS;gBAC5C,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE;gBACtD,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC;SACN,CAAC,CAAA;IACH,CAAC;IACD,MAAM,IAAI,iCAAiC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;AACtE,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,MAA4B;IACpD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,WAAW,MAAM,CAAC,OAAO,EAAE,CAAA;IACjE,OAAO,aAAa,MAAM,CAAC,OAAO,IAAI,QAAQ,EAAE,CAAA;AACjD,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,OAAO,iCAAkC,SAAQ,KAAK;IAG/B;IAFV,IAAI,GAAG,mCAAmC,CAAA;IAE5D,YAA4B,OAAe;QAC1C,KAAK,CACJ,oBAAoB,OAAO,2FAA2F,CACtH,CAAA;QAH0B,YAAO,GAAP,OAAO,CAAQ;IAI3C,CAAC;CACD;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,qCAAsC,SAAQ,KAAK;IAI9C;IAHC,IAAI,GAAG,uCAAuC,CAAA;IAEhE,YACiB,OAA0B,EAC1C,OAA6B;QAE7B,KAAK,CACJ,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACvD,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CACnE,CAAA;QANe,YAAO,GAAP,OAAO,CAAmB;IAO3C,CAAC;IAED,MAAM;QAML,OAAO;YACN,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAA;IACF,CAAC;CACD;AAsDD;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,KAAc;IAC7C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;IAChE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;IAC1E,IAAI,OAAO,KAAK,KAAK,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;IACnF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAA;IACnF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAA;IACnF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;IAC3D,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;IACpD,CAAC;IACD,6DAA6D;IAC7D,gEAAgE;IAChE,gDAAgD;IAChD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAA;AAC3D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAY;IACjD,OAAO,kBAAkB,CAAC,GAAG,EAAE,IAAI,OAAO,EAAE,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY,EAAE,IAAqB;IAC9D,iEAAiE;IACjE,gEAAgE;IAChE,8DAA8D;IAC9D,iDAAiD;IACjD,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,EAAE,CAAC;QAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;YAC9E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACd,CAAC;QACD,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAA;IACnC,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;IAC5D,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAEb,MAAM,GAAG,GAML;QACH,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,GAAG,CAAC,OAAO;KACpB,CAAA;IACD,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;QAAE,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAA;IAClD,IAAI,GAAG,YAAY,qCAAqC,EAAE,CAAC;QAC1D,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAA;IAC1B,CAAC;IACD,gEAAgE;IAChE,8DAA8D;IAC9D,kEAAkE;IAClE,IAAI,OAAO,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/C,GAAG,CAAC,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IAChD,CAAC;IACD,OAAO,GAAG,CAAA;AACX,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACpC,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;AACF,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@namzu/sandbox",
|
|
3
|
-
"version": "
|
|
3
|
+
"version": "6.0.0",
|
|
4
4
|
"description": "Pluggable sandbox provider for @namzu/sdk. Process-level isolation (bubblewrap on Linux, Seatbelt on macOS, via @anthropic-ai/sandbox-runtime) for developer dev loops; container-level isolation (HTTP worker + a loopback-bound egress proxy that allows by resolved address and brokers outbound credentials so they never enter the sandbox) for multi-tenant production. Backend selected at construction time; the SDK consumes both through the same SandboxProvider interface.",
|
|
5
5
|
"license": "FSL-1.1-MIT",
|
|
6
6
|
"type": "module",
|
|
@@ -50,16 +50,16 @@
|
|
|
50
50
|
"@types/node": "^22.19.17",
|
|
51
51
|
"typescript": "^5.5.0",
|
|
52
52
|
"vitest": "^3.2.6",
|
|
53
|
-
"@namzu/sdk": "^
|
|
53
|
+
"@namzu/sdk": "^28.0.0"
|
|
54
54
|
},
|
|
55
55
|
"scripts": {
|
|
56
56
|
"build": "tsc --build",
|
|
57
57
|
"dev": "tsc --build --watch",
|
|
58
|
-
"lint": "biome check src/",
|
|
58
|
+
"lint": "biome check src/ worker/ agent/",
|
|
59
59
|
"lint:fix": "biome check --write src/",
|
|
60
60
|
"format": "biome format --write src/",
|
|
61
61
|
"test": "vitest run --passWithNoTests",
|
|
62
|
-
"test:smoke": "vitest run --
|
|
62
|
+
"test:smoke": "vitest run --config vitest.smoke.config.ts",
|
|
63
63
|
"typecheck": "tsc --noEmit"
|
|
64
64
|
}
|
|
65
65
|
}
|
|
@@ -51,6 +51,7 @@ import type {
|
|
|
51
51
|
SandboxId,
|
|
52
52
|
SandboxStatus,
|
|
53
53
|
} from '@namzu/sdk'
|
|
54
|
+
import { asSandboxId } from '@namzu/sdk'
|
|
54
55
|
|
|
55
56
|
import type { SandboxBackend, SandboxBackendOptions } from '../../index.js'
|
|
56
57
|
|
|
@@ -271,7 +272,7 @@ function generateSandboxId(): SandboxId {
|
|
|
271
272
|
const ts = Date.now().toString(36)
|
|
272
273
|
const rand = Math.random().toString(36).slice(2, 8)
|
|
273
274
|
_sandboxIdCounter += 1
|
|
274
|
-
return `sbx_${ts}_${rand}_${_sandboxIdCounter}`
|
|
275
|
+
return asSandboxId(`sbx_${ts}_${rand}_${_sandboxIdCounter}`)
|
|
275
276
|
}
|
|
276
277
|
|
|
277
278
|
async function armCall<T>(
|
|
@@ -40,6 +40,7 @@ import {
|
|
|
40
40
|
type SandboxFileEntry,
|
|
41
41
|
type SandboxId,
|
|
42
42
|
type SandboxStatus,
|
|
43
|
+
asSandboxId,
|
|
43
44
|
withHint,
|
|
44
45
|
} from '@namzu/sdk'
|
|
45
46
|
import { EgressProxy } from '../../egress/index.js'
|
|
@@ -186,10 +187,17 @@ export function buildDockerBackend(config: DockerBackendInternalConfig): Sandbox
|
|
|
186
187
|
*
|
|
187
188
|
* The policy used to be accepted and silently ignored, which is worse than
|
|
188
189
|
* not supporting it: a host that set `deny-all` believed the container had
|
|
189
|
-
* no network and it had the configured one.
|
|
190
|
-
*
|
|
191
|
-
*
|
|
192
|
-
*
|
|
190
|
+
* no network and it had the configured one. It cannot enforce a host
|
|
191
|
+
* allowlist without a proxy this backend does not have, so those policies
|
|
192
|
+
* are REFUSED rather than quietly downgraded to "allow everything".
|
|
193
|
+
*
|
|
194
|
+
* `deny-all` used to answer `'none'`, which reads as the strictest possible
|
|
195
|
+
* answer and produced a sandbox nobody could reach. `--network none`
|
|
196
|
+
* removes every interface, and this backend's control channel is inbound
|
|
197
|
+
* TCP to the worker — so removing the interfaces removes the way IN, not
|
|
198
|
+
* just the way out. It now keeps the configured network, and
|
|
199
|
+
* {@link assertNetworkCarriesThePolicy} is what makes that network a
|
|
200
|
+
* boundary.
|
|
193
201
|
*/
|
|
194
202
|
export function resolveNetwork(
|
|
195
203
|
configured: string,
|
|
@@ -200,7 +208,6 @@ export function resolveNetwork(
|
|
|
200
208
|
|
|
201
209
|
switch (egress.kind) {
|
|
202
210
|
case 'deny-all':
|
|
203
|
-
return 'none'
|
|
204
211
|
case 'allow-all':
|
|
205
212
|
return configured
|
|
206
213
|
default:
|
|
@@ -237,6 +244,68 @@ export function needsEgressProxy(egress: EgressPolicy | undefined): boolean {
|
|
|
237
244
|
return egress?.kind === 'static' || egress?.kind === 'resolver'
|
|
238
245
|
}
|
|
239
246
|
|
|
247
|
+
/**
|
|
248
|
+
* Whether the daemon says a network has no route out.
|
|
249
|
+
*
|
|
250
|
+
* Takes the raw `docker network inspect --format '{{.Internal}}'` output
|
|
251
|
+
* rather than reading it, so every decision below is testable without a
|
|
252
|
+
* daemon and the daemon call stays one line. Anything other than a literal
|
|
253
|
+
* `true` counts as "not internal": an unreadable answer is not evidence of
|
|
254
|
+
* a boundary.
|
|
255
|
+
*/
|
|
256
|
+
export function isInternalNetwork(inspectedInternalFlag: string): boolean {
|
|
257
|
+
return inspectedInternalFlag.trim() === 'true'
|
|
258
|
+
}
|
|
259
|
+
|
|
260
|
+
/**
|
|
261
|
+
* Refuse a container whose network cannot do what was asked of it.
|
|
262
|
+
*
|
|
263
|
+
* Two requirements meet on the same object here, and both were previously
|
|
264
|
+
* unstated — which is how the backend came to ship a default configuration
|
|
265
|
+
* that could not create a sandbox at all:
|
|
266
|
+
*
|
|
267
|
+
* - **A published host port needs a route out.** Docker binds the port by
|
|
268
|
+
* NAT to the container's address, so a container with no address gets no
|
|
269
|
+
* binding. Measured against Docker 29.6: `--network none --publish
|
|
270
|
+
* 127.0.0.1::2024` is *accepted*, `NetworkSettings.Ports` comes back
|
|
271
|
+
* `{"2024/tcp":[]}`, and `docker port` prints nothing. An `--internal`
|
|
272
|
+
* network behaves the same way. The port readback then failed with
|
|
273
|
+
* `index of untyped nil` and reported it as "the container exited
|
|
274
|
+
* immediately" — blaming a container that was alive and well.
|
|
275
|
+
* - **`deny-all` needs a network with no route out.** Since it no longer
|
|
276
|
+
* answers `--network none`, the configured name is all that stands
|
|
277
|
+
* between the policy and ordinary outbound networking, and a name says
|
|
278
|
+
* nothing. `deny-all` pointed at the default bridge would be full egress
|
|
279
|
+
* under a policy object claiming none — the "accepted and silently
|
|
280
|
+
* ignored" failure the rest of this file exists to refuse.
|
|
281
|
+
*
|
|
282
|
+
* They are exact opposites, so `deny-all` over a published host port is
|
|
283
|
+
* impossible rather than merely unsupported: no arrangement of docker
|
|
284
|
+
* networking both denies all egress and lets the host reach the worker over
|
|
285
|
+
* TCP. Closing that needs the control channel moved off TCP — see #398 —
|
|
286
|
+
* and is not a flag this function could accept.
|
|
287
|
+
*/
|
|
288
|
+
export function assertNetworkCarriesThePolicy(
|
|
289
|
+
network: string,
|
|
290
|
+
reachability: 'host-port' | 'container-network',
|
|
291
|
+
egress: EgressPolicy | undefined,
|
|
292
|
+
inspectedInternalFlag: string,
|
|
293
|
+
): void {
|
|
294
|
+
const internal = isInternalNetwork(inspectedInternalFlag)
|
|
295
|
+
|
|
296
|
+
if (reachability === 'host-port' && (network === 'none' || internal)) {
|
|
297
|
+
throw new Error(
|
|
298
|
+
`The docker sandbox backend cannot publish the worker's port on network '${network}': docker binds a published port to the container's address, and a container with no route out has no address to bind to, so nothing is published and the sandbox is unreachable. Either give config.network a bridge that has one, or set hostReachability: 'container-network' and reach the worker by container name. Refusing rather than starting a container nobody can reach.`,
|
|
299
|
+
)
|
|
300
|
+
}
|
|
301
|
+
|
|
302
|
+
if (egress?.kind === 'deny-all' && !internal) {
|
|
303
|
+
throw new Error(
|
|
304
|
+
`The docker sandbox backend was asked for an egress policy of 'deny-all' on network '${network}', but that network is not internal, so the container can still reach the world. Create it with 'docker network create --internal ${network}' — an internal bridge denies egress in the kernel, rather than through an environment variable a workload may decline to read, while sibling containers still reach the worker by name. Refusing rather than reporting a boundary that is not there.`,
|
|
305
|
+
)
|
|
306
|
+
}
|
|
307
|
+
}
|
|
308
|
+
|
|
240
309
|
/**
|
|
241
310
|
* The options the boundary is built from, as a value.
|
|
242
311
|
*
|
|
@@ -273,6 +342,30 @@ export function egressProxyOptions(
|
|
|
273
342
|
* `--cap-drop=ALL` is deliberately not softened by a re-add list: a
|
|
274
343
|
* workload that genuinely needs a capability should say so through
|
|
275
344
|
* `extraRunArgs` and be visible in review.
|
|
345
|
+
*
|
|
346
|
+
* **It carries a second, independent load, and this is the one that would
|
|
347
|
+
* survive being forgotten.** An egress policy of `deny-all` is enforced by
|
|
348
|
+
* the container's network being `--internal`, which gives it no route out.
|
|
349
|
+
* Measured against Docker 29.6: a container on such a network has only its
|
|
350
|
+
* own subnet in `ip route` and no default, and `ip route add default via
|
|
351
|
+
* <a sibling>` answers `RTNETLINK answers: Operation not permitted` —
|
|
352
|
+
* already, with docker's DEFAULT capability set, before this flag is
|
|
353
|
+
* applied. `NET_ADMIN` is what would lift that, and dropping every
|
|
354
|
+
* capability is what guarantees the workload does not have it.
|
|
355
|
+
*
|
|
356
|
+
* So the internal network removes the route and this flag removes the
|
|
357
|
+
* ability to put one back. Both are needed. Measured on a container given
|
|
358
|
+
* `--cap-add=NET_ADMIN`, adding the route and reaching a sibling attached
|
|
359
|
+
* to an external bridge produces `download timed out` rather than
|
|
360
|
+
* `Network unreachable` — the route existed, the packet left, and the
|
|
361
|
+
* dual-homed sibling forwarded it (`net.ipv4.ip_forward` is `1` inside a
|
|
362
|
+
* container). Nothing masquerades the internal subnet so no reply finds its
|
|
363
|
+
* way back and no connection establishes, **but that is not a security
|
|
364
|
+
* property**: one-way egress is sufficient for exfiltration, and what was
|
|
365
|
+
* measured is that the handshake fails, not that the packet was dropped.
|
|
366
|
+
*
|
|
367
|
+
* Recorded here because the first justification above would survive
|
|
368
|
+
* softening this flag and the second would not.
|
|
276
369
|
*/
|
|
277
370
|
const HARDENING_ARGS: readonly string[] = ['--cap-drop=ALL', '--security-opt=no-new-privileges']
|
|
278
371
|
|
|
@@ -297,13 +390,33 @@ async function spawnDockerSandbox(
|
|
|
297
390
|
egressProxy = await new EgressProxy(egressProxyOptions(config, policy)).listen()
|
|
298
391
|
}
|
|
299
392
|
|
|
393
|
+
const hostReachability = config.hostReachability ?? 'host-port'
|
|
300
394
|
const network = resolveNetwork(
|
|
301
395
|
config.network ?? 'none',
|
|
302
396
|
options.egress,
|
|
303
397
|
egressProxy !== undefined,
|
|
304
398
|
)
|
|
399
|
+
// Whether this network can carry the reachability mode and the policy is
|
|
400
|
+
// a fact about the network, so it is checked against the daemon rather
|
|
401
|
+
// than inferred from its name. Before the container starts on purpose: a
|
|
402
|
+
// refusal here is a wiring mistake and must not arrive dressed as a
|
|
403
|
+
// container that failed to come up, which is exactly how it used to
|
|
404
|
+
// arrive.
|
|
405
|
+
try {
|
|
406
|
+
assertNetworkCarriesThePolicy(
|
|
407
|
+
network,
|
|
408
|
+
hostReachability,
|
|
409
|
+
options.egress,
|
|
410
|
+
await inspectNetworkInternalFlag(docker, network),
|
|
411
|
+
)
|
|
412
|
+
} catch (err) {
|
|
413
|
+
// The allowlist kinds start a proxy above, and this is outside the
|
|
414
|
+
// try/catch that owns teardown — so without this the refusal would
|
|
415
|
+
// leave a listening server on loopback stamping real credentials.
|
|
416
|
+
await egressProxy?.close().catch(() => undefined)
|
|
417
|
+
throw err
|
|
418
|
+
}
|
|
305
419
|
const runtime = config.runtime
|
|
306
|
-
const hostReachability = config.hostReachability ?? 'host-port'
|
|
307
420
|
const containerName = `namzu-sandbox-${id}`
|
|
308
421
|
|
|
309
422
|
// All bind sources come from the consumer-supplied layout. The
|
|
@@ -752,8 +865,18 @@ function detectEnvironment(): SandboxEnvironment {
|
|
|
752
865
|
}
|
|
753
866
|
|
|
754
867
|
function generateSandboxId(): SandboxId {
|
|
868
|
+
// `sbx_`, not `sandbox_`. `SandboxId` is `` `sbx_${string}` `` and this
|
|
869
|
+
// backend minted `sandbox_...` for it — the `as SandboxId` was the only
|
|
870
|
+
// reason that compiled, and every docker sandbox in the tree carried an id
|
|
871
|
+
// its own type says is impossible. The ACI backend already mints `sbx_`.
|
|
872
|
+
//
|
|
873
|
+
// The container name derives from this (`namzu-sandbox-${id}`), so a
|
|
874
|
+
// container started by an older build has a different name. Nothing
|
|
875
|
+
// matches on the old spelling — teardown computes the name from the id it
|
|
876
|
+
// just minted, in the same process — but it is a visible change in
|
|
877
|
+
// `docker ps`.
|
|
755
878
|
const random = Math.random().toString(36).slice(2, 10)
|
|
756
|
-
return `
|
|
879
|
+
return asSandboxId(`sbx_${Date.now().toString(36)}_${random}`)
|
|
757
880
|
}
|
|
758
881
|
|
|
759
882
|
async function waitForWorkerReady(
|
|
@@ -806,6 +929,23 @@ function runOnce(binary: string, args: string[]): Promise<string> {
|
|
|
806
929
|
})
|
|
807
930
|
}
|
|
808
931
|
|
|
932
|
+
/**
|
|
933
|
+
* Read a network's `Internal` flag from the daemon.
|
|
934
|
+
*
|
|
935
|
+
* A network that does not exist, or a daemon that is down, comes back as the
|
|
936
|
+
* empty string rather than throwing, so {@link assertNetworkCarriesThePolicy}
|
|
937
|
+
* refuses it for the reason the caller actually cares about — "this is not
|
|
938
|
+
* a boundary" — instead of surfacing a docker CLI error that says nothing
|
|
939
|
+
* about the egress policy that prompted the lookup.
|
|
940
|
+
*/
|
|
941
|
+
async function inspectNetworkInternalFlag(docker: string, network: string): Promise<string> {
|
|
942
|
+
try {
|
|
943
|
+
return await runOnce(docker, ['network', 'inspect', '--format', '{{.Internal}}', network])
|
|
944
|
+
} catch {
|
|
945
|
+
return ''
|
|
946
|
+
}
|
|
947
|
+
}
|
|
948
|
+
|
|
809
949
|
function runOnceQuiet(binary: string, args: string[]): Promise<void> {
|
|
810
950
|
return new Promise((resolve) => {
|
|
811
951
|
const child = spawn(binary, args, { stdio: 'ignore' })
|
|
@@ -358,6 +358,13 @@ async function spawnFirecrackerSandbox(
|
|
|
358
358
|
throw new Error('firecracker: orchestrator create returned no sandboxId / agent handle')
|
|
359
359
|
}
|
|
360
360
|
|
|
361
|
+
// Cast, not `asSandboxId`, and the reason is that this id is MINTED BY THE
|
|
362
|
+
// ORCHESTRATOR — a service outside this repo whose prefix nothing here can
|
|
363
|
+
// establish. `SandboxId` says `sbx_`; if the orchestrator mints anything
|
|
364
|
+
// else, a checked constructor turns a working deployment into a hard
|
|
365
|
+
// failure on the strength of a guess. The honest state is that this cast is
|
|
366
|
+
// unverified, and verifying it needs the orchestrator's contract, not a
|
|
367
|
+
// change here.
|
|
361
368
|
const id = created.sandboxId as SandboxId
|
|
362
369
|
const rootDir = created.rootDir
|
|
363
370
|
// Normalise the orchestrator handle: fill the contract vsock port when a
|
package/src/index.ts
CHANGED
|
@@ -203,11 +203,19 @@ export interface ContainerBackendConfig {
|
|
|
203
203
|
readonly hostReachability?: 'host-port' | 'container-network'
|
|
204
204
|
/**
|
|
205
205
|
* Docker network the spawned container attaches to. Default
|
|
206
|
-
* `'none'` (no inbound or outbound network).
|
|
207
|
-
*
|
|
208
|
-
*
|
|
209
|
-
*
|
|
210
|
-
*
|
|
206
|
+
* `'none'` (no inbound or outbound network).
|
|
207
|
+
*
|
|
208
|
+
* **The default does not work with the default `hostReachability`,
|
|
209
|
+
* and `create()` refuses rather than starting a container nobody can
|
|
210
|
+
* reach.** Docker binds a published port to the container's address,
|
|
211
|
+
* so a container with no route out has no address to bind to and
|
|
212
|
+
* nothing is published. Name a bridge here to reach the worker by host
|
|
213
|
+
* port, or set `hostReachability: 'container-network'` and reach it by
|
|
214
|
+
* container name — that mode works on an `--internal` network, which
|
|
215
|
+
* is also the only way to get `deny-all` enforced.
|
|
216
|
+
*
|
|
217
|
+
* Egress from the sandbox is governed separately by `EgressPolicy`,
|
|
218
|
+
* which is checked against this network rather than trusted.
|
|
211
219
|
*/
|
|
212
220
|
readonly network?: 'none' | 'bridge' | string
|
|
213
221
|
/**
|