@su-record/vibe 2.7.6 → 2.7.8

package/dist/pc/sandbox/ContainerConfig.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Container Security Config — Phase 5-1
+ *
+ * Rootless, read-only FS, dropped capabilities, seccomp, resource limits.
+ */
+import type { SecurityConfig, SeccompProfile } from './types.js';
+export declare function getDefaultSeccompProfile(): SeccompProfile;
+export declare function getDefaultSecurityConfig(): SecurityConfig;
+export interface DockerHostConfig {
+    ReadonlyRootfs: boolean;
+    SecurityOpt: string[];
+    CapDrop: string[];
+    CapAdd: string[];
+    Tmpfs: Record<string, string>;
+    NanoCpus: number;
+    Memory: number;
+    PidsLimit: number;
+    NetworkMode: string;
+    Devices: never[];
+    UsernsMode: string;
+}
+export declare function buildHostConfig(security: SecurityConfig, cpuLimit: number, memoryMb: number, pidLimit: number, networkMode: string): DockerHostConfig;
+export declare function filterEnvVars(env: Record<string, string>): string[];
+//# sourceMappingURL=ContainerConfig.d.ts.map

package/dist/pc/sandbox/ContainerConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ContainerConfig.d.ts","sourceRoot":"","sources":["../../../src/pc/sandbox/ContainerConfig.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAMjE,wBAAgB,wBAAwB,IAAI,cAAc,CAqCzD;AAMD,wBAAgB,wBAAwB,IAAI,cAAc,CAczD;AAMD,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,OAAO,CAAC;IACxB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,KAAK,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,gBAAgB,CAsBlB;AAeD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAInE"}

package/dist/pc/sandbox/ContainerConfig.js

@@ -0,0 +1,103 @@
+/**
+ * Container Security Config — Phase 5-1
+ *
+ * Rootless, read-only FS, dropped capabilities, seccomp, resource limits.
+ */
+// ============================================================================
+// Default Seccomp Profile (deny io_uring, allow common syscalls)
+// ============================================================================
+export function getDefaultSeccompProfile() {
+    return {
+        defaultAction: 'SCMP_ACT_ERRNO',
+        syscalls: [
+            {
+                names: [
+                    'read', 'write', 'open', 'close', 'stat', 'fstat', 'lstat',
+                    'poll', 'lseek', 'mmap', 'mprotect', 'munmap', 'brk',
+                    'ioctl', 'access', 'pipe', 'select', 'sched_yield',
+                    'dup', 'dup2', 'pause', 'nanosleep', 'getpid', 'socket',
+                    'connect', 'accept', 'sendto', 'recvfrom', 'bind', 'listen',
+                    'clone', 'fork', 'vfork', 'execve', 'exit', 'wait4',
+                    'kill', 'uname', 'fcntl', 'flock', 'fsync', 'fdatasync',
+                    'truncate', 'ftruncate', 'getdents', 'getcwd', 'chdir',
+                    'rename', 'mkdir', 'rmdir', 'link', 'unlink', 'symlink',
+                    'readlink', 'chmod', 'chown', 'umask', 'gettimeofday',
+                    'getuid', 'getgid', 'setuid', 'setgid', 'geteuid', 'getegid',
+                    'epoll_create', 'epoll_ctl', 'epoll_wait', 'epoll_create1',
+                    'eventfd', 'eventfd2', 'signalfd', 'timerfd_create',
+                    'futex', 'set_robust_list', 'get_robust_list',
+                    'clock_gettime', 'clock_getres', 'clock_nanosleep',
+                    'exit_group', 'set_tid_address', 'openat', 'mkdirat',
+                    'newfstatat', 'unlinkat', 'renameat', 'readlinkat',
+                    'pipe2', 'getrandom', 'memfd_create', 'statx',
+                    'pread64', 'pwrite64', 'writev', 'readv',
+                    'getdents64', 'prlimit64', 'arch_prctl',
+                    'setsockopt', 'getsockopt', 'getpeername', 'getsockname',
+                ],
+                action: 'SCMP_ACT_ALLOW',
+            },
+            {
+                // Explicitly deny io_uring (CVE-2025-9002)
+                names: ['io_uring_setup', 'io_uring_enter', 'io_uring_register'],
+                action: 'SCMP_ACT_ERRNO',
+            },
+        ],
+    };
+}
+// ============================================================================
+// Default Security Config
+// ============================================================================
+export function getDefaultSecurityConfig() {
+    return {
+        readonlyRootfs: true,
+        noNewPrivileges: true,
+        dropCapabilities: ['ALL'],
+        addCapabilities: ['CHOWN', 'SETUID', 'SETGID', 'DAC_OVERRIDE', 'NET_BIND_SERVICE'],
+        seccompProfile: getDefaultSeccompProfile(),
+        tmpfsMounts: [
+            { destination: '/tmp', size: '256m' },
+            { destination: '/workspace', size: '512m' },
+        ],
+        userNamespaceRemap: true,
+        deviceAccess: false,
+    };
+}
+export function buildHostConfig(security, cpuLimit, memoryMb, pidLimit, networkMode) {
+    const tmpfs = {};
+    for (const mount of security.tmpfsMounts) {
+        tmpfs[mount.destination] = `size=${mount.size},noexec,nosuid`;
+    }
+    return {
+        ReadonlyRootfs: security.readonlyRootfs,
+        SecurityOpt: [
+            'no-new-privileges:true',
+            `seccomp=${JSON.stringify(security.seccompProfile)}`,
+        ],
+        CapDrop: security.dropCapabilities,
+        CapAdd: security.addCapabilities,
+        Tmpfs: tmpfs,
+        NanoCpus: cpuLimit * 1e9,
+        Memory: memoryMb * 1024 * 1024,
+        PidsLimit: pidLimit,
+        NetworkMode: networkMode,
+        Devices: [],
+        UsernsMode: security.userNamespaceRemap ? 'host' : '',
+    };
+}
+// ============================================================================
+// Env variable filter (block dangerous vars)
+// ============================================================================
+const BLOCKED_ENV_PREFIXES = [
+    'NODE_OPTIONS',
+    'DYLD_',
+    'LD_PRELOAD',
+    'LD_LIBRARY_PATH',
+    'DOCKER_HOST',
+    'PYTHONPATH',
+];
+export function filterEnvVars(env) {
+    return Object.entries(env)
+        .filter(([key]) => !BLOCKED_ENV_PREFIXES.some(prefix => key.startsWith(prefix)))
+        .map(([key, value]) => `${key}=${value}`);
+}
+//# sourceMappingURL=ContainerConfig.js.map

package/dist/pc/sandbox/ContainerConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ContainerConfig.js","sourceRoot":"","sources":["../../../src/pc/sandbox/ContainerConfig.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,+EAA+E;AAC/E,iEAAiE;AACjE,+EAA+E;AAE/E,MAAM,UAAU,wBAAwB;IACtC,OAAO;QACL,aAAa,EAAE,gBAAgB;QAC/B,QAAQ,EAAE;YACR;gBACE,KAAK,EAAE;oBACL,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;oBAC1D,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK;oBACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa;oBAClD,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ;oBACvD,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ;oBAC3D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO;oBACnD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW;oBACvD,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO;oBACtD,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;oBACvD,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc;oBACrD,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;oBAC5D,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe;oBAC1D,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB;oBACnD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB;oBAC7C,eAAe,EAAE,cAAc,EAAE,iBAAiB;oBAClD,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS;oBACpD,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY;oBAClD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO;oBAC7C,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO;oBACxC,YAAY,EAAE,WAAW,EAAE,YAAY;oBACvC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa;iBACzD;gBACD,MAAM,EAAE,gBAAgB;aACzB;YACD;gBACE,2CAA2C;gBAC3C,KAAK,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,mBAAmB,CAAC;gBAChE,MAAM,EAAE,gBAAgB;aACzB;SACF;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E,MAAM,UAAU,wBAAwB;IACtC,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,eAAe,EAAE,IAAI;QACrB,gBAAgB,EAAE,CAAC,KAAK,CAAC;QACzB,eAAe,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,kBAAkB,CAAC;QAClF,cAAc,EAAE,wBAAwB,EAAE;QAC1C,WAAW,EAAE;YACX,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;YACrC,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE;SAC5C;QACD,kBAAkB,EAAE,IAAI;QACxB,YAAY,EAAE,KAAK;KACpB,CAAC;AACJ,CAAC;AAoBD,MAAM,UAAU,eAAe,CAC7B,QAAwB,EACxB,QAAgB,EAChB,QAAgB,EAChB,QAAgB,EAChB,WAAmB;IAEnB,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,QAAQ,KAAK,CAAC,IAAI,gBAAgB,CAAC;IAChE,CAAC;IAED,OAAO;QACL,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,WAAW,EAAE;YACX,wBAAwB;YACxB,WAAW,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE;SACrD;QACD,OAAO,EAAE,QAAQ,CAAC,gBAAgB;QAClC,MAAM,EAAE,QAAQ,CAAC,eAAe;QAChC,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,QAAQ,GAAG,GAAG;QACxB,MAAM,EAAE,QAAQ,GAAG,IAAI,GAAG,IAAI;QAC9B,SAAS,EAAE,QAAQ;QACnB,WAAW,EAAE,WAAW;QACxB,OAAO,EAAE,EAAE;QACX,UAAU,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;KACtD,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,6CAA6C;AAC7C,+EAA+E;AAE/E,MAAM,oBAAoB,GAAG;IAC3B,cAAc;IACd,OAAO;IACP,YAAY;IACZ,iBAAiB;IACjB,aAAa;IACb,YAAY;CACb,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,GAA2B;IACvD,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SACvB,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;SAC/E,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;AAC9C,CAAC"}

package/dist/pc/sandbox/ContainerManager.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Container Manager — Phase 5-1
+ *
+ * Docker container lifecycle: create, start, stop, remove, exec.
+ * Warm pool for fast provisioning. Auto-cleanup for inactive containers.
+ */
+import type { ContainerInfo, ContainerCreateOptions, ExecResult, SandboxLogger } from './types.js';
+export declare class ContainerManager {
+    private docker;
+    private containers;
+    private logger;
+    private cleanupTimer;
+    constructor(logger: SandboxLogger);
+    init(): Promise<void>;
+    create(userId: string, options?: Partial<ContainerCreateOptions>): Promise<ContainerInfo>;
+    start(containerId: string): Promise<void>;
+    stop(containerId: string): Promise<void>;
+    remove(containerId: string): Promise<void>;
+    exec(containerId: string, command: string[]): Promise<ExecResult>;
+    getContainers(): ContainerInfo[];
+    getUserContainers(userId: string): ContainerInfo[];
+    cleanup(): Promise<number>;
+    shutdown(): Promise<void>;
+    private loadDockerode;
+    private ping;
+    private ensureDocker;
+    private getContainerInfo;
+    private enforceContainerLimits;
+    private startCleanupTimer;
+}
+//# sourceMappingURL=ContainerManager.d.ts.map

package/dist/pc/sandbox/ContainerManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ContainerManager.d.ts","sourceRoot":"","sources":["../../../src/pc/sandbox/ContainerManager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,sBAAsB,EAEtB,UAAU,EACV,aAAa,EACd,MAAM,YAAY,CAAC;AAiCpB,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,MAAM,CAAkC;IAChD,OAAO,CAAC,UAAU,CAAoC;IACtD,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,YAAY,CAA+B;gBAEvC,MAAM,EAAE,aAAa;IAI3B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAMrB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;IAkEzF,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASzC,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQxC,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO1C,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IA4DvE,aAAa,IAAI,aAAa,EAAE;IAIhC,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE;IAI5C,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IAkB1B,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;YAiBjB,aAAa;YAWb,IAAI;IASlB,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,sBAAsB;IAW9B,OAAO,CAAC,iBAAiB;CAQ1B"}

package/dist/pc/sandbox/ContainerManager.js

@@ -0,0 +1,245 @@
+/**
+ * Container Manager — Phase 5-1
+ *
+ * Docker container lifecycle: create, start, stop, remove, exec.
+ * Warm pool for fast provisioning. Auto-cleanup for inactive containers.
+ */
+import { DEFAULT_CONTAINER_CONFIG, createSandboxError } from './types.js';
+import { getDefaultSecurityConfig, buildHostConfig } from './ContainerConfig.js';
+// ============================================================================
+// Container Manager
+// ============================================================================
+export class ContainerManager {
+    docker = null;
+    containers = new Map();
+    logger;
+    cleanupTimer = null;
+    constructor(logger) {
+        this.logger = logger;
+    }
+    async init() {
+        this.docker = await this.loadDockerode();
+        await this.ping();
+        this.startCleanupTimer();
+    }
+    async create(userId, options) {
+        this.ensureDocker();
+        this.enforceContainerLimits(userId);
+        const config = {
+            image: options?.image ?? DEFAULT_CONTAINER_CONFIG.image,
+            cpuLimit: options?.cpuLimit ?? DEFAULT_CONTAINER_CONFIG.cpuLimit,
+            memoryLimitMb: options?.memoryLimitMb ?? DEFAULT_CONTAINER_CONFIG.memoryLimitMb,
+            pidLimit: options?.pidLimit ?? DEFAULT_CONTAINER_CONFIG.pidLimit,
+            networkMode: options?.networkMode ?? 'none',
+            scope: options?.scope ?? 'user',
+        };
+        const security = getDefaultSecurityConfig();
+        const hostConfig = buildHostConfig(security, config.cpuLimit, config.memoryLimitMb, config.pidLimit, config.networkMode);
+        const labels = {
+            'vibe-user-id': userId,
+            'vibe-scope': config.scope,
+            'vibe-session-id': `session-${Date.now()}`,
+            ...options?.labels,
+        };
+        let container;
+        let retries = DEFAULT_CONTAINER_CONFIG.createRetries;
+        while (true) {
+            try {
+                container = await this.docker.createContainer({
+                    Image: config.image,
+                    Labels: labels,
+                    HostConfig: hostConfig,
+                    User: '1000:1000',
+                    WorkingDir: '/workspace',
+                    Cmd: ['sleep', 'infinity'],
+                });
+                break;
+            }
+            catch (err) {
+                if (retries <= 0) {
+                    throw createSandboxError('CONTAINER_CREATE_FAILED', `컨테이너 생성 실패: ${err instanceof Error ? err.message : String(err)}`);
+                }
+                retries--;
+                this.logger('warn', `Container create retry (${retries} left)`);
+            }
+        }
+        const info = {
+            containerId: container.id,
+            userId,
+            scope: config.scope,
+            state: 'creating',
+            createdAt: new Date().toISOString(),
+            lastActivityAt: new Date().toISOString(),
+            cpuLimit: config.cpuLimit,
+            memoryLimitMb: config.memoryLimitMb,
+            pidLimit: config.pidLimit,
+            labels,
+        };
+        this.containers.set(container.id, info);
+        return info;
+    }
+    async start(containerId) {
+        this.ensureDocker();
+        const info = this.getContainerInfo(containerId);
+        const container = this.docker.getContainer(containerId);
+        await container.start();
+        info.state = 'running';
+        info.lastActivityAt = new Date().toISOString();
+    }
+    async stop(containerId) {
+        this.ensureDocker();
+        const info = this.getContainerInfo(containerId);
+        const container = this.docker.getContainer(containerId);
+        await container.stop({ t: 5 });
+        info.state = 'stopped';
+    }
+    async remove(containerId) {
+        this.ensureDocker();
+        const container = this.docker.getContainer(containerId);
+        await container.remove({ force: true });
+        this.containers.delete(containerId);
+    }
+    async exec(containerId, command) {
+        this.ensureDocker();
+        const info = this.getContainerInfo(containerId);
+        if (info.state !== 'running') {
+            throw createSandboxError('EXEC_FAILED', '컨테이너가 실행 중이 아닙니다.');
+        }
+        const container = this.docker.getContainer(containerId);
+        const start = Date.now();
+        const execInstance = await container.exec({
+            Cmd: command,
+            AttachStdout: true,
+            AttachStderr: true,
+            User: '1000:1000',
+        });
+        return new Promise((resolve) => {
+            let resolved = false;
+            const safeResolve = (result) => {
+                if (resolved)
+                    return;
+                resolved = true;
+                clearTimeout(timeout);
+                resolve(result);
+            };
+            const timeout = setTimeout(() => {
+                safeResolve({
+                    exitCode: -1,
+                    stdout: '',
+                    stderr: '명령 실행 시간이 30초를 초과했습니다.',
+                    durationMs: Date.now() - start,
+                    timedOut: true,
+                });
+            }, DEFAULT_CONTAINER_CONFIG.execTimeoutMs);
+            execInstance.start({ Detach: false }).then((stream) => {
+                let stdout = '';
+                let stderr = '';
+                stream.on('data', (chunk) => {
+                    stdout += String(chunk);
+                });
+                stream.on('end', () => {
+                    info.lastActivityAt = new Date().toISOString();
+                    safeResolve({ exitCode: 0, stdout, stderr, durationMs: Date.now() - start, timedOut: false });
+                });
+                stream.on('error', (err) => {
+                    stderr = err instanceof Error ? err.message : String(err);
+                    safeResolve({ exitCode: 1, stdout, stderr, durationMs: Date.now() - start, timedOut: false });
+                });
+            }).catch((err) => {
+                safeResolve({
+                    exitCode: 1, stdout: '', stderr: err instanceof Error ? err.message : String(err),
+                    durationMs: Date.now() - start, timedOut: false,
+                });
+            });
+        });
+    }
+    getContainers() {
+        return Array.from(this.containers.values());
+    }
+    getUserContainers(userId) {
+        return this.getContainers().filter(c => c.userId === userId);
+    }
+    async cleanup() {
+        const now = Date.now();
+        let removed = 0;
+        for (const [id, info] of this.containers) {
+            const idle = now - new Date(info.lastActivityAt).getTime();
+            if (idle > DEFAULT_CONTAINER_CONFIG.inactivityTimeoutMs && info.state === 'running') {
+                try {
+                    await this.stop(id);
+                    await this.remove(id);
+                    removed++;
+                }
+                catch (err) {
+                    this.logger('warn', `Cleanup failed for ${id}: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+        }
+        return removed;
+    }
+    async shutdown() {
+        if (this.cleanupTimer) {
+            clearInterval(this.cleanupTimer);
+            this.cleanupTimer = null;
+        }
+        for (const [id] of this.containers) {
+            try {
+                await this.remove(id);
+            }
+            catch { /* best effort */ }
+        }
+        this.containers.clear();
+    }
+    // ============================================================================
+    // Private
+    // ============================================================================
+    async loadDockerode() {
+        try {
+            const mod = 'dockerode';
+            const imported = (await import(mod));
+            return new imported.default();
+        }
+        catch {
+            throw createSandboxError('DOCKER_NOT_RUNNING', 'dockerode 패키지가 설치되지 않았습니다. npm install dockerode');
+        }
+    }
+    async ping() {
+        try {
+            await this.docker.ping();
+        }
+        catch {
+            throw createSandboxError('DOCKER_NOT_RUNNING', "Docker 데몬이 실행되지 않습니다. 'docker start' 또는 Docker Desktop을 실행해주세요.");
+        }
+    }
+    ensureDocker() {
+        if (!this.docker) {
+            throw createSandboxError('DOCKER_NOT_RUNNING', 'ContainerManager가 초기화되지 않았습니다. init()을 먼저 호출하세요.');
+        }
+    }
+    getContainerInfo(containerId) {
+        const info = this.containers.get(containerId);
+        if (!info) {
+            throw createSandboxError('CONTAINER_NOT_FOUND', `컨테이너를 찾을 수 없습니다: ${containerId}`);
+        }
+        return info;
+    }
+    enforceContainerLimits(userId) {
+        const total = this.containers.size;
+        if (total >= DEFAULT_CONTAINER_CONFIG.maxContainersTotal) {
+            throw createSandboxError('MAX_CONTAINERS_REACHED', `최대 컨테이너 수(${DEFAULT_CONTAINER_CONFIG.maxContainersTotal})에 도달했습니다.`);
+        }
+        const userCount = this.getUserContainers(userId).length;
+        if (userCount >= DEFAULT_CONTAINER_CONFIG.maxContainersPerUser) {
+            throw createSandboxError('MAX_CONTAINERS_REACHED', `사용자당 최대 컨테이너 수(${DEFAULT_CONTAINER_CONFIG.maxContainersPerUser})에 도달했습니다.`);
+        }
+    }
+    startCleanupTimer() {
+        // Check every 5 minutes
+        this.cleanupTimer = setInterval(() => {
+            this.cleanup().catch((err) => {
+                this.logger('error', `Auto-cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
+            });
+        }, 5 * 60 * 1000);
+    }
+}
+//# sourceMappingURL=ContainerManager.js.map

package/dist/pc/sandbox/ContainerManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ContainerManager.js","sourceRoot":"","sources":["../../../src/pc/sandbox/ContainerManager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AA2BjF,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E,MAAM,OAAO,gBAAgB;IACnB,MAAM,GAA6B,IAAI,CAAC;IACxC,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC9C,MAAM,CAAgB;IACtB,YAAY,GAA0B,IAAI,CAAC;IAEnD,YAAY,MAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,OAAyC;QACpE,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAEpC,MAAM,MAAM,GAAG;YACb,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,wBAAwB,CAAC,KAAK;YACvD,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,wBAAwB,CAAC,QAAQ;YAChE,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,wBAAwB,CAAC,aAAa;YAC/E,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,wBAAwB,CAAC,QAAQ;YAChE,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,MAAM;YAC3C,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,MAAM;SAChC,CAAC;QAEF,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,eAAe,CAChC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,CACrF,CAAC;QAEF,MAAM,MAAM,GAAG;YACb,cAAc,EAAE,MAAM;YACtB,YAAY,EAAE,MAAM,CAAC,KAAK;YAC1B,iBAAiB,EAAE,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE;YAC1C,GAAG,OAAO,EAAE,MAAM;SACnB,CAAC;QAEF,IAAI,SAA6B,CAAC;QAClC,IAAI,OAAO,GAAG,wBAAwB,CAAC,aAAa,CAAC;QAErD,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,IAAI,CAAC,MAAO,CAAC,eAAe,CAAC;oBAC7C,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,UAAU;oBACtB,IAAI,EAAE,WAAW;oBACjB,UAAU,EAAE,YAAY;oBACxB,GAAG,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;iBAC3B,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;oBACjB,MAAM,kBAAkB,CAAC,yBAAyB,EAChD,eAAe,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACvE,CAAC;gBACD,OAAO,EAAE,CAAC;gBACV,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,2BAA2B,OAAO,QAAQ,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAkB;YAC1B,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,MAAM;YACN,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM;SACP,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,WAAmB;QAC7B,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAO,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACzD,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,CAAC,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,WAAmB;QAC5B,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAO,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACzD,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC9B,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAO,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACzD,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,WAAmB,EAAE,OAAiB;QAC/C,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,kBAAkB,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,MAAO,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEzB,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC;YACxC,GAAG,EAAE,OAAO;YACZ,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,IAAI;YAClB,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;QAEH,OAAO,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,EAAE;YACzC,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,MAAM,WAAW,GAAG,CAAC,MAAkB,EAAQ,EAAE;gBAC/C,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC;YAEF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC9B,WAAW,CAAC;oBACV,QAAQ,EAAE,CAAC,CAAC;oBACZ,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,wBAAwB;oBAChC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;oBAC9B,QAAQ,EAAE,IAAI;iBACf,CAAC,CAAC;YACL,CAAC,EAAE,wBAAwB,CAAC,aAAa,CAAC,CAAC;YAE3C,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBACpD,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,MAAM,GAAG,EAAE,CAAC;gBAEhB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAc,EAAE,EAAE;oBACnC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1B,CAAC,CAAC,CAAC;gBACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACpB,IAAI,CAAC,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;oBAC/C,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;gBAChG,CAAC,CAAC,CAAC;gBACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAY,EAAE,EAAE;oBAClC,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC1D,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;gBAChG,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACxB,WAAW,CAAC;oBACV,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;oBACjF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK;iBAChD,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,aAAa;QACX,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,iBAAiB,CAAC,MAAc;QAC9B,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC;YAC3D,IAAI,IAAI,GAAG,wBAAwB,CAAC,mBAAmB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACpF,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACpB,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACtB,OAAO,EAAE,CAAC;gBACZ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,EAAE,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACvG,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACjC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED,+EAA+E;IAC/E,UAAU;IACV,+EAA+E;IAEvE,KAAK,CAAC,aAAa;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,WAAW,CAAC;YACxB,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,CAA6C,CAAC;YACjF,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,kBAAkB,CAAC,oBAAoB,EAC3C,kDAAkD,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,kBAAkB,CAAC,oBAAoB,EAC3C,iEAAiE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,kBAAkB,CAAC,oBAAoB,EAAE,kDAAkD,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,WAAmB;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,kBAAkB,CAAC,qBAAqB,EAAE,oBAAoB,WAAW,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,sBAAsB,CAAC,MAAc;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QACnC,IAAI,KAAK,IAAI,wBAAwB,CAAC,kBAAkB,EAAE,CAAC;YACzD,MAAM,kBAAkB,CAAC,wBAAwB,EAAE,aAAa,wBAAwB,CAAC,kBAAkB,YAAY,CAAC,CAAC;QAC3H,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QACxD,IAAI,SAAS,IAAI,wBAAwB,CAAC,oBAAoB,EAAE,CAAC;YAC/D,MAAM,kBAAkB,CAAC,wBAAwB,EAAE,kBAAkB,wBAAwB,CAAC,oBAAoB,YAAY,CAAC,CAAC;QAClI,CAAC;IACH,CAAC;IAEO,iBAAiB;QACvB,wBAAwB;QACxB,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;YACnC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC3B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,wBAAwB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnG,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACpB,CAAC;CACF"}

package/dist/pc/sandbox/ContainerManager.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ContainerManager.test.d.ts.map

package/dist/pc/sandbox/ContainerManager.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ContainerManager.test.d.ts","sourceRoot":"","sources":["../../../src/pc/sandbox/ContainerManager.test.ts"],"names":[],"mappings":""}