hammerkit 1.26.0 → 1.27.0-next.1

package/dist/server/server-config.js

@@ -1,12 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.detectPlatform = exports.getSecretCatalog = exports.readServerConfig = exports.getSourceAccounts = exports.serverConfigSchema = exports.sourceSchema = exports.entitlementSchema = exports.buildsLevelSchema = exports.accountLevelSchema = exports.accountSchema = exports.definitionName = exports.issuerSchema = exports.serverPlatformSchema = void 0;
+exports.detectPlatform = exports.getSecretCatalog = exports.readServerConfig = exports.getSourceAccounts = exports.getSandboxRuntimes = exports.serverConfigSchema = exports.sourceSchema = exports.entitlementSchema = exports.sandboxGrantSchema = exports.sandboxBranchTypeSchema = exports.buildsLevelSchema = exports.accountLevelSchema = exports.getMaxVolumeSize = exports.DEFAULT_MAX_VOLUME_SIZE = exports.DEFAULT_DENIED_EGRESS = exports.kubernetesPoolSchema = exports.accountSchema = exports.issuerSchema = exports.serverPlatformSchema = void 0;
+const net_1 = require("net");
 const zod_1 = require("zod");
 const yaml_1 = require("yaml");
 const log_1 = require("../log");
 const units_1 = require("../utils/units");
+const version_1 = require("../version");
+const network_schema_1 = require("../schema/network-schema");
 const build_file_secret_provider_schema_1 = require("../schema/build-file-secret-provider-schema");
 const repo_1 = require("./repo");
+const work_network_1 = require("../planner/work-network");
 const LOOPBACK_HOSTS = ['127.0.0.1', 'localhost', '::1'];
 exports.serverPlatformSchema = zod_1.z
     .object({
@@ -40,10 +44,6 @@ exports.issuerSchema = zod_1.z
     scope: zod_1.z.string().min(1).default('openid'),
 })
     .strict();
-// What a published build file is called: the project, as a build file author names it.
-exports.definitionName = zod_1.z
-    .string()
-    .regex(/^[a-z0-9][a-z0-9._-]{0,63}$/i, 'use letters, digits, ".", "_" and "-", starting with a letter or digit');
 const subjectSchema = zod_1.z.object({ iss: zod_1.z.string().min(1), sub: zod_1.z.string().min(1) }).strict();
 const groupSchema = zod_1.z.object({ iss: zod_1.z.string().min(1), name: zod_1.z.string().min(1) }).strict();
 const claimsSchema = zod_1.z.object({ iss: zod_1.z.string().min(1), match: zod_1.z.record(zod_1.z.string()) }).strict();
@@ -70,20 +70,42 @@ function checkWho(who, ctx) {
 const accountNameSchema = zod_1.z
     .string()
     .regex(/^[A-Za-z][A-Za-z0-9_-]*$/, 'a name starts with a letter and holds letters, digits, - and _');
+const kubernetesNameSchema = zod_1.z
+    .string()
+    .regex(/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/, 'a Kubernetes name: lower case letters, digits and -');
 exports.accountSchema = zod_1.z
     .object({
     description: zod_1.z.string().min(1).max(200).optional(),
     // per secret provider, the environment that makes its command act as this
     // account; the credentials are files and variables of the operator's machine
     providers: build_file_secret_provider_schema_1.buildFileSecretAccountSchema.shape.providers.default({}),
-    // where the code of a run using this account may come from; both when left out
+    // where the code of a run using this account may come from: `upload` and `ref` when
+    // left out; a sandbox, which holds unreviewed changes, only when it is listed
     source: zod_1.z
-        .array(zod_1.z.enum(['upload', 'ref']))
+        .array(zod_1.z.enum(['upload', 'ref', 'sandbox']))
         .min(1)
         .optional(),
     // the refs (branches or tags, `release/*` for a level) a run using this account
     // may be started from; a commit is not accepted then, it names no branch
     refs: zod_1.z.array(zod_1.z.string().min(1).max(200)).min(1).optional(),
+    // On a Kubernetes backend: the credential the commands of the account's secrets
+    // get in the Job of a task, under /var/run/hammerkit/account. The server holds
+    // none of the secret manager's credentials.
+    kubernetes: zod_1.z
+        .object({
+        // a ServiceAccount of the server's namespace: a token of it (an hour, made for
+        // each Job, for `audience`) is put at /var/run/hammerkit/account/token, for a cloud that
+        // trusts the cluster's issuer (workload identity federation)
+        serviceAccount: kubernetesNameSchema.optional(),
+        audience: zod_1.z.string().min(1).optional(),
+        // a Secret of the server's namespace, each key a file of the directory, such
+        // as a key file or the federation config that reads the token
+        secret: kubernetesNameSchema.optional(),
+    })
+        .strict()
+        .refine((value) => value.serviceAccount || value.secret, 'name a serviceAccount, a secret or both')
+        .refine((value) => !value.audience || value.serviceAccount, 'audience is the one of the serviceAccount token')
+        .optional(),
 })
     .strict()
     .superRefine((account, ctx) => {
@@ -95,11 +117,198 @@ exports.accountSchema = zod_1.z
         });
     }
 });
+// The tasks of runs execute on this machine, with its docker daemon and local tools.
+const hostBackendSchema = zod_1.z
+    .object({
+    type: zod_1.z.literal('host'),
+    // what this machine offers; detected when left out
+    platform: exports.serverPlatformSchema.optional(),
+})
+    .strict();
+const tolerationSchema = zod_1.z
+    .object({
+    key: zod_1.z.string().min(1).optional(),
+    operator: zod_1.z.enum(['Exists', 'Equal']).optional(),
+    value: zod_1.z.string().optional(),
+    effect: zod_1.z.enum(['NoSchedule', 'PreferNoSchedule', 'NoExecute']).optional(),
+    tolerationSeconds: zod_1.z.number().int().min(0).optional(),
+})
+    .strict();
+// an IPv4 or IPv6 range, such as 10.0.0.0/8
+const cidrSchema = zod_1.z.string().refine((value) => {
+    const [address, prefix, ...rest] = value.split('/');
+    const family = (0, net_1.isIP)(address);
+    return (rest.length === 0 && family !== 0 && /^\d{1,3}$/.test(prefix ?? '') && Number(prefix) <= (family === 4 ? 32 : 128));
+}, 'expected an address range, such as 10.0.0.0/8 or fd00::/8');
+const quantitiesSchema = zod_1.z.object({ cpu: zod_1.z.string().min(1).optional(), memory: zod_1.z.string().min(1).optional() }).strict();
+// Nodes the tasks of runs are placed on. Container tasks go to the first pool; a
+// local task runs in the `toolImage` of the pool that offers the platform it declares.
+exports.kubernetesPoolSchema = zod_1.z
+    .object({
+    name: kubernetesNameSchema,
+    // Linux only: macOS is not a node platform, Windows nodes are not supported yet
+    platform: zod_1.z
+        .object({ os: zod_1.z.literal('linux'), arch: zod_1.z.enum(['amd64', 'arm64']) })
+        .strict()
+        .default({ os: 'linux', arch: 'amd64' }),
+    // labels the nodes of the pool carry, besides kubernetes.io/os and kubernetes.io/arch
+    nodeSelector: zod_1.z.record(zod_1.z.string()).default({}),
+    tolerations: zod_1.z.array(tolerationSchema).default([]),
+    // the image local tasks run in on this pool
+    toolImage: zod_1.z.string().min(1).optional(),
+})
+    .strict();
+// The tasks of runs execute as Jobs on a cluster, in a namespace per caller.
+const duration = zod_1.z.string().refine((value) => {
+    try {
+        return (0, units_1.parseDuration)(value) > 0;
+    }
+    catch {
+        return false;
+    }
+}, 'expected a duration like 30m, 1h or 1d');
+const size = zod_1.z.string().refine((value) => {
+    try {
+        return (0, units_1.parseSize)(value) > 0;
+    }
+    catch {
+        return false;
+    }
+}, 'expected a size like 500Mi, 20Gi or 1Ti');
+// Where a cluster keeps sandboxes: a claim per sandbox in its caller's namespace
+const kubernetesSandboxesSchema = zod_1.z
+    .object({
+    // the image of the short pods that fetch, read and change the files of a sandbox:
+    // hammerkit with git and ripgrep, as the image of this version is
+    image: zod_1.z.string().min(1).default(`no0dles/hammerkit:${(0, version_1.getVersion)()}`),
+    // what each of the two claims of a sandbox requests: one holds its files, which tasks
+    // mount, the other its git data, which only the pod of its files mounts
+    size: size.default('4Gi'),
+    // of the claims of sandboxes; the class of tasks' claims, else the cluster's default,
+    // when left out. With a class of their own, a ResourceQuota on that class in each
+    // caller's namespace holds `sandboxes.limits`.
+    storageClass: zod_1.z.string().min(1).optional(),
+    // how long the pod of a sandbox's files stays after the last request
+    idle: duration.default('1m'),
+    // of the pod of a sandbox's files, which runs git and ripgrep over all of them
+    resources: zod_1.z
+        .object({ requests: quantitiesSchema.optional(), limits: quantitiesSchema.optional() })
+        .strict()
+        .default({ requests: { cpu: '100m', memory: '256Mi' }, limits: { memory: '2Gi' } }),
+})
+    .strict()
+    .default({});
+exports.DEFAULT_DENIED_EGRESS = [
+    '169.254.0.0/16',
+    '10.0.0.0/8',
+    '172.16.0.0/12',
+    '192.168.0.0/16',
+    '100.64.0.0/10',
+    'fe80::/10',
+    'fc00::/7',
+];
+const kubernetesBackendSchema = zod_1.z
+    .object({
+    type: zod_1.z.literal('kubernetes'),
+    // the cluster: a context of a kubeconfig, or the cluster the server runs in when
+    // both are left out
+    kubeconfig: zod_1.z.string().min(1).optional(),
+    context: zod_1.z.string().min(1).optional(),
+    // the server's own namespace, where the Secrets and ServiceAccounts of the accounts
+    // are; the namespace of the server's pod when left out
+    namespace: kubernetesNameSchema.optional(),
+    // a caller's namespace is this and a hash of their identity, so two servers on
+    // one cluster keep their callers apart with a prefix each
+    namespacePrefix: zod_1.z
+        .string()
+        .regex(/^[a-z0-9][a-z0-9-]{0,30}$/, 'lower case letters, digits and -, at most 31')
+        .default('hammerkit-'),
+    // of the claims tasks get; the cluster's default when left out
+    storageClass: zod_1.z.string().min(1).optional(),
+    // what the claim of a task or service requests when it states no `volumeSize`, and
+    // the most one may state (see getMaxVolumeSize when left out)
+    volumeSize: size.default('1Gi'),
+    maxVolumeSize: size.optional(),
+    // how long the claim of a task stays after the run that mounted it last, for the next
+    // run of the same source to mount its outputs as they are; false removes it at the end
+    // of the run
+    keepVolumes: zod_1.z.union([duration, zod_1.z.literal(false)]).default('15m'),
+    pools: zod_1.z
+        .array(exports.kubernetesPoolSchema)
+        .min(1)
+        .default([{ name: 'default', platform: { os: 'linux', arch: 'amd64' }, nodeSelector: {}, tolerations: [] }]),
+    // per secret provider, the image its command runs in: secrets are read in the
+    // Job of the task, not by the server
+    providers: zod_1.z.record(zod_1.z.object({ image: zod_1.z.string().min(1) }).strict()).default({}),
+    // the ResourceQuota of every caller's namespace, such as `requests.cpu: '8'`
+    quota: zod_1.z.record(zod_1.z.union([zod_1.z.string().min(1), zod_1.z.number()]).transform(String)).optional(),
+    // what a container without `resources` requests (a LimitRange), so it is
+    // admitted under a quota that limits compute
+    defaultResources: zod_1.z
+        .object({ requests: quantitiesSchema.optional(), limits: quantitiesSchema.optional() })
+        .strict()
+        .optional(),
+    sandboxes: kubernetesSandboxesSchema,
+    // the ClusterRole the server binds to itself in each caller's namespace, so it needs
+    // no rights in the namespaces of others (see the docs on RBAC)
+    runRole: kubernetesNameSchema.default('hammerkit-runs'),
+    // where the pods of runs with an open network may not connect to: by default the
+    // link-local ranges with the metadata endpoints of the clouds (and the node's identity)
+    // and the private ones, where the cluster's nodes, pods and services and the networks
+    // behind it are, so `open` means the internet
+    deniedEgress: zod_1.z.array(cidrSchema).default(exports.DEFAULT_DENIED_EGRESS),
+    // the addresses in deniedEgress they may reach anyway, such as an internal registry
+    // or a database a TCP forward of `allow` goes to
+    allowedEgress: zod_1.z.array(cidrSchema).default([]),
+    // the operator states that the cluster's network plugin enforces NetworkPolicy, as a
+    // build file's environment does: hammerkit can't tell from the API, and without it a
+    // task with a limited network fails rather than runs open
+    networkPolicy: zod_1.z.literal('enforced').optional(),
+})
+    .strict();
+// the most a task's claim may request on a server whose operator states no maxVolumeSize
+exports.DEFAULT_MAX_VOLUME_SIZE = '10Gi';
+// The most a task's or service's claim may request: the operator's maxVolumeSize, else
+// DEFAULT_MAX_VOLUME_SIZE or the backend's volumeSize when that is more. A build file
+// states its volumeSize, so without a bound any caller could make the operator pay for a
+// disk of any size.
+function getMaxVolumeSize(backend) {
+    if (backend.maxVolumeSize) {
+        return backend.maxVolumeSize;
+    }
+    return (0, units_1.parseSize)(backend.volumeSize) > (0, units_1.parseSize)(exports.DEFAULT_MAX_VOLUME_SIZE)
+        ? backend.volumeSize
+        : exports.DEFAULT_MAX_VOLUME_SIZE;
+}
+exports.getMaxVolumeSize = getMaxVolumeSize;
 exports.accountLevelSchema = zod_1.z.enum(['use', 'request']);
 // What a caller may do with the build files: run what is published, propose new
 // versions that someone else approves, or publish. Each level includes the lower.
 exports.buildsLevelSchema = zod_1.z.enum(['run', 'propose', 'publish']);
 const repoPatternSchema = zod_1.z.string().refine(repo_1.isRepoPattern, 'expected host/path, such as github.com/corp/*');
+// A branch of a sandbox grant, as written: `agent/**`, `agent/*` (one level) or a name.
+const branchPatternSchema = zod_1.z
+    .string()
+    .min(1)
+    .max(200)
+    .refine((value) => /^[A-Za-z0-9._*/-]+$/.test(value) &&
+    !value.startsWith('-') &&
+    !value.startsWith('/') &&
+    !value.endsWith('/') &&
+    !value.includes('//') &&
+    !value.includes('..'), 'expected a branch or a pattern of branches, such as agent/**');
+// `pull`: a sandbox may start from (and fetch) a matching branch; `push` also pushes to it.
+exports.sandboxBranchTypeSchema = zod_1.z.enum(['pull', 'push']);
+// One repository (`host/path` pattern) an entitlement may keep sandboxes of, with a type
+// per branch pattern. Its branches count for this repository only.
+exports.sandboxGrantSchema = zod_1.z
+    .object({
+    repo: repoPatternSchema,
+    branches: zod_1.z
+        .record(branchPatternSchema, exports.sandboxBranchTypeSchema)
+        .refine((branches) => Object.keys(branches).length > 0, 'name the branches a sandbox may start from'),
+})
+    .strict();
 exports.entitlementSchema = zod_1.z
     .object({
     ...whoShape,
@@ -109,14 +318,19 @@ exports.entitlementSchema = zod_1.z
     // the repositories (`host/path` patterns) the caller may run from a git ref
     repos: zod_1.z.array(repoPatternSchema).default([]),
     builds: exports.buildsLevelSchema.optional(),
+    // the repositories the caller may keep sandboxes of, checkouts on the server that runs
+    // work on: a list of its own, the `repos` above are for runs from a ref
+    sandboxes: zod_1.z.array(exports.sandboxGrantSchema).optional(),
 })
     .strict()
     .superRefine((entitlement, ctx) => {
     checkWho(entitlement, ctx);
-    if (Object.keys(entitlement.accounts).length === 0 && entitlement.builds === undefined) {
+    if (Object.keys(entitlement.accounts).length === 0 &&
+        entitlement.builds === undefined &&
+        !entitlement.sandboxes?.length) {
         ctx.addIssue({
             code: zod_1.z.ZodIssueCode.custom,
-            message: 'name accounts to use or request, or a builds level',
+            message: 'name accounts to use or request, a builds level or sandboxes',
         });
     }
 });
@@ -137,14 +351,6 @@ exports.sourceSchema = zod_1.z
         .optional(),
 })
     .strict();
-const duration = zod_1.z.string().refine((value) => {
-    try {
-        return (0, units_1.parseDuration)(value) > 0;
-    }
-    catch {
-        return false;
-    }
-}, 'expected a duration like 30m, 1h or 1d');
 // The server config is written by an operator and reviewed like code, so a typo
 // is an error and not a silently ignored key.
 exports.serverConfigSchema = zod_1.z
@@ -242,17 +448,47 @@ exports.serverConfigSchema = zod_1.z
         })
             .strict()
             .default({}),
+        // the most any task or service of a run reaches besides its needs: none, open
+        // or { allow: [hosts] }. A version that asks for more is refused at publish.
+        network: network_schema_1.networkSchema.default('open'),
     })
         .strict()
         .default({}),
-    backend: zod_1.z
+    // checkouts of callers on the server that runs work on (the `sandboxes` of an
+    // entitlement). They stay until they are deleted, within these limits.
+    sandboxes: zod_1.z
         .object({
-        type: zod_1.z.literal('host'),
-        // what this machine offers; detected when left out
-        platform: exports.serverPlatformSchema.optional(),
+        // what the tasks of a run on a sandbox may run on, out of `runtimes`. A local task
+        // would run as the user of the server and could read every other sandbox, so
+        // `local` has to be named here too. Left out, `docker` when the server runs
+        // containers, see getSandboxRuntimes
+        runtimes: zod_1.z
+            .array(zod_1.z.enum(['docker', 'local']))
+            .min(1)
+            .optional(),
+        // the most open network a task or service of a run on a sandbox gets, written as
+        // a task's `network`: only the services it needs by default
+        network: network_schema_1.networkSchema.default('none'),
+        // the variables of `runs.env.allow` an `env:` secret of a run on a sandbox may
+        // read: none by default, a sandbox holds code nobody reviewed
+        env: zod_1.z
+            .object({ allow: zod_1.z.array(zod_1.z.string().regex(/^[A-Za-z_][A-Za-z0-9_()]*$/)).default([]) })
+            .strict()
+            .default({}),
+        // what one caller may keep; a sandbox over it can't be created
+        limits: zod_1.z
+            .object({
+            count: zod_1.z.number().int().min(1).default(5),
+            bytes: size.default('20Gi'),
+        })
+            .strict()
+            .default({}),
+        // what all sandboxes together may take
+        total: size.default('500Gi'),
     })
         .strict()
-        .default({ type: 'host' }),
+        .default({}),
+    backend: zod_1.z.discriminatedUnion('type', [hostBackendSchema, kubernetesBackendSchema]).default({ type: 'host' }),
 })
     .strict()
     .superRefine((config, ctx) => {
@@ -331,6 +567,153 @@ exports.serverConfigSchema = zod_1.z
             }
         }
     });
+    const sandboxNetwork = (0, work_network_1.parseWorkNetwork)(config.sandboxes.network);
+    const runsNetwork = (0, work_network_1.parseWorkNetwork)(config.runs.network);
+    if ((0, work_network_1.exceedsNetwork)(sandboxNetwork, runsNetwork)) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['sandboxes', 'network'],
+            message: `runs on sandboxes get at most runs.network (${(0, work_network_1.formatNetwork)(runsNetwork)}), not ${(0, work_network_1.formatNetwork)(sandboxNetwork)}`,
+        });
+    }
+    // what a sandbox run gets, the lower of the two: their TCP forwards together need a port each
+    const sandboxCeiling = (0, work_network_1.limitNetwork)(sandboxNetwork, runsNetwork);
+    const shared = sandboxCeiling.type === 'allow' ? (0, network_schema_1.getAllowListError)(sandboxCeiling.hosts) : null;
+    if (shared) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['sandboxes', 'network'],
+            message: `under runs.network, ${shared}`,
+        });
+    }
+    if (config.sandboxes.runtimes?.includes('local') && config.sandboxes.network !== 'open') {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['sandboxes', 'network'],
+            message: 'hammerkit can not limit the network of a local task, set network: open to allow local in sandboxes',
+        });
+    }
+    config.sandboxes.env.allow.forEach((name, index) => {
+        if (!config.runs.env.allow.includes(name)) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['sandboxes', 'env', 'allow', index],
+                message: `${name} is not in runs.env.allow, no run can read it`,
+            });
+        }
+    });
+    config.sandboxes.runtimes?.forEach((runtime, index) => {
+        if (!config.runtimes.includes(runtime)) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['sandboxes', 'runtimes', index],
+                message: `the runtime ${runtime} is not in runtimes, the server does not run on it at all`,
+            });
+        }
+    });
+    const backend = config.backend;
+    for (const [name, account] of Object.entries(config.accounts)) {
+        if (account.kubernetes && backend.type !== 'kubernetes') {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['accounts', name, 'kubernetes'],
+                message: 'kubernetes credentials are for backend.type: kubernetes',
+            });
+        }
+    }
+    if (backend.type === 'kubernetes') {
+        const pools = new Set();
+        backend.pools.forEach((pool, index) => {
+            if (pools.has(pool.name)) {
+                ctx.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    path: ['backend', 'pools', index, 'name'],
+                    message: `the pool ${pool.name} is named twice`,
+                });
+            }
+            pools.add(pool.name);
+        });
+        // the secrets of tasks are read in their Job, with the image of the provider; the
+        // ones of the sources are read by the server, which checks the code out itself
+        const readers = getSourceAccounts(config);
+        for (const [name, account] of Object.entries(config.accounts)) {
+            if (readers.includes(name)) {
+                continue;
+            }
+            // the commands run as the account's own identity, never the one of the node
+            // or of the provider's image, which every account would share
+            if (Object.keys(account.providers).length > 0 && !account.kubernetes) {
+                ctx.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    path: ['accounts', name, 'kubernetes'],
+                    message: `the account ${name} reads secrets in the Jobs of tasks, name the serviceAccount or secret it reads them as`,
+                });
+            }
+            for (const provider of Object.keys(account.providers)) {
+                if (!backend.providers[provider]) {
+                    ctx.addIssue({
+                        code: zod_1.z.ZodIssueCode.custom,
+                        path: ['backend', 'providers', provider],
+                        message: `the account ${name} reads ${provider} in the Jobs of tasks, name the image to run it in`,
+                    });
+                }
+            }
+        }
+        if (backend.maxVolumeSize && (0, units_1.parseSize)(backend.volumeSize) > (0, units_1.parseSize)(backend.maxVolumeSize)) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['backend', 'volumeSize'],
+                message: `a claim of ${backend.volumeSize} is more than maxVolumeSize of ${backend.maxVolumeSize}`,
+            });
+        }
+        const sandboxes = backend.sandboxes;
+        if (sandboxes.storageClass && sandboxes.storageClass === backend.storageClass) {
+            // the quota on the class would count the claims of tasks too
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['backend', 'sandboxes', 'storageClass'],
+                message: 'give sandboxes a storage class of their own, or leave it out to use the one of tasks',
+            });
+        }
+        if ((0, units_1.parseSize)(sandboxes.size) > (0, units_1.parseSize)(config.sandboxes.limits.bytes)) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['backend', 'sandboxes', 'size'],
+                message: `a sandbox of ${sandboxes.size} is more than sandboxes.limits.bytes of ${config.sandboxes.limits.bytes}`,
+            });
+        }
+        if (config.runtimes.includes('local') && !backend.pools.some((pool) => pool.toolImage)) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['backend', 'pools'],
+                message: 'local tasks run in the toolImage of a pool, give a pool one or remove local from runtimes',
+            });
+        }
+        // a limited network is a NetworkPolicy there, which only some network plugins enforce
+        if (config.runs.network !== 'open' && backend.networkPolicy !== 'enforced') {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['backend', 'networkPolicy'],
+                message: 'runs.network limits every task with a NetworkPolicy, set networkPolicy: enforced once the network plugin of the cluster enforces them',
+            });
+        }
+        if (config.sandboxes.network !== 'open' &&
+            backend.networkPolicy !== 'enforced' &&
+            config.entitlements.some((entitlement) => entitlement.sandboxes?.length)) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['backend', 'networkPolicy'],
+                message: 'sandboxes.network limits the tasks of sandboxes with a NetworkPolicy, set networkPolicy: enforced once the network plugin of the cluster enforces them, or sandboxes.network: open',
+            });
+        }
+    }
+    if (config.runs.network !== 'open' && config.runtimes.includes('local')) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['runs', 'network'],
+            message: 'the network of a local task can not be limited, allow only the docker runtime with runs.network',
+        });
+    }
     if (!config.tls && !config.behindTlsProxy && !LOOPBACK_HOSTS.includes(config.listen.host)) {
         ctx.addIssue({
             code: zod_1.z.ZodIssueCode.custom,
@@ -339,6 +722,13 @@ exports.serverConfigSchema = zod_1.z
         });
     }
 });
+// What the tasks of a run on a sandbox may run on: `sandboxes.runtimes`, else containers
+// when the server runs them. Empty on a server with only `runtimes: [local]`, which then
+// runs nothing on sandboxes.
+function getSandboxRuntimes(config) {
+    return config.sandboxes.runtimes ?? config.runtimes.filter((runtime) => runtime === 'docker');
+}
+exports.getSandboxRuntimes = getSandboxRuntimes;
 // The accounts that read repositories: no caller uses them and no build file names them.
 function getSourceAccounts(config) {
     return [...new Set(config.sources.flatMap((source) => (source.secret ? [source.secret.account] : [])))];