isol8 0.1.0-alpha.2 → 0.3.0

package/dist/index.js

@@ -135,8 +135,8 @@ var DEFAULT_CONFIG = {
     memoryLimit: "512m",
     cpuLimit: 1,
     network: "none",
-    sandboxSize: "64m",
-    tmpSize: "64m"
+    sandboxSize: "512m",
+    tmpSize: "256m"
   },
   network: {
     whitelist: [],
@@ -619,11 +619,11 @@ function wrapWithTimeout(cmd, timeoutSec) {
 function getInstallCommand(runtime, packages) {
   switch (runtime) {
     case "python":
-      return ["pip", "install", "--no-cache-dir", "--break-system-packages", ...packages];
+      return ["pip", "install", "--user", "--no-cache-dir", "--break-system-packages", ...packages];
     case "node":
-      return ["npm", "install", "-g", ...packages];
+      return ["npm", "install", "-g", "--prefix=/sandbox/.npm-global", ...packages];
     case "bun":
-      return ["bun", "install", "-g", ...packages];
+      return ["bun", "install", "-g", "--global-dir=/sandbox/.bun-global", ...packages];
     case "deno":
       return ["sh", "-c", packages.map((p) => `deno cache ${p}`).join(" && ")];
     case "bash":
@@ -635,10 +635,23 @@ function getInstallCommand(runtime, packages) {
 async function installPackages(container, runtime, packages) {
   const cmd = getInstallCommand(runtime, packages);
   console.error(`[DEBUG] Installing packages: ${JSON.stringify(cmd)}`);
+  const env = [
+    "PATH=/sandbox/.local/bin:/sandbox/.npm-global/bin:/sandbox/.bun-global/bin:/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin:/sbin"
+  ];
+  if (runtime === "python") {
+    env.push("PYTHONUSERBASE=/sandbox/.local");
+  } else if (runtime === "node") {
+    env.push("NPM_CONFIG_PREFIX=/sandbox/.npm-global");
+    env.push("NPM_CONFIG_CACHE=/sandbox/.npm-cache");
+    env.push("npm_config_cache=/sandbox/.npm-cache");
+  } else if (runtime === "deno") {
+    env.push("DENO_DIR=/sandbox/.deno");
+  }
   const exec = await container.exec({
     Cmd: cmd,
     AttachStdout: true,
-    AttachStderr: true
+    AttachStderr: true,
+    Env: env
   });
   const stream = await exec.start({ Detach: false, Tty: false });
   return new Promise((resolve2, reject) => {
@@ -698,8 +711,8 @@ class DockerIsol8 {
     this.defaultTimeoutMs = options.timeoutMs ?? 30000;
     this.overrideImage = options.image;
     this.semaphore = new Semaphore(maxConcurrent);
-    this.sandboxSize = options.sandboxSize ?? "64m";
-    this.tmpSize = options.tmpSize ?? "64m";
+    this.sandboxSize = options.sandboxSize ?? "512m";
+    this.tmpSize = options.tmpSize ?? "256m";
   }
   async start() {}
   async stop() {
@@ -1012,8 +1025,8 @@ class DockerIsol8 {
       PidsLimit: this.pidsLimit,
       ReadonlyRootfs: this.readonlyRootFs,
       Tmpfs: {
-        "/tmp": `rw,noexec,nosuid,size=${this.tmpSize}`,
-        [SANDBOX_WORKDIR]: `rw,size=${this.sandboxSize}`
+        "/tmp": `rw,noexec,nosuid,nodev,size=${this.tmpSize}`,
+        [SANDBOX_WORKDIR]: `rw,exec,nosuid,nodev,size=${this.sandboxSize}`
       },
       SecurityOpt: ["no-new-privileges"]
     };
@@ -1027,7 +1040,11 @@ class DockerIsol8 {
   buildEnv(extra) {
     const env = [
       "PYTHONUNBUFFERED=1",
-      "NODE_PATH=/usr/local/lib/node_modules:/sandbox/node_modules"
+      "PYTHONUSERBASE=/sandbox/.local",
+      "NPM_CONFIG_PREFIX=/sandbox/.npm-global",
+      "DENO_DIR=/sandbox/.deno",
+      "PATH=/sandbox/.local/bin:/sandbox/.npm-global/bin:/sandbox/.bun-global/bin:/usr/local/bin:/usr/bin:/bin",
+      "NODE_PATH=/usr/local/lib/node_modules:/sandbox/.npm-global/lib/node_modules:/sandbox/node_modules"
     ];
     for (const [key, value] of Object.entries(this.secrets)) {
       env.push(`${key}=${value}`);
@@ -1166,6 +1183,26 @@ class DockerIsol8 {
     }
     return result.trimEnd();
   }
+  static async cleanup(docker) {
+    const dockerInstance = docker ?? new Docker;
+    const containers = await dockerInstance.listContainers({ all: true });
+    const isol8Containers = containers.filter((c) => c.Image.startsWith("isol8:") || c.Image.startsWith("isol8-custom:"));
+    let removed = 0;
+    let failed = 0;
+    const errors = [];
+    for (const containerInfo of isol8Containers) {
+      try {
+        const container = dockerInstance.getContainer(containerInfo.Id);
+        await container.remove({ force: true });
+        removed++;
+      } catch (err) {
+        failed++;
+        const errorMsg = err instanceof Error ? err.message : String(err);
+        errors.push(`${containerInfo.Id.slice(0, 12)}: ${errorMsg}`);
+      }
+    }
+    return { removed, failed, errors };
+  }
 }
 // src/server/index.ts
 import { Hono } from "hono";
@@ -1341,10 +1378,118 @@ function createServer(options) {
     port: options.port
   };
 }
+// package.json
+var package_default = {
+  name: "isol8",
+  version: "0.2.0",
+  description: "Secure code execution engine for AI agents",
+  author: "Illusion47586",
+  license: "MIT",
+  repository: {
+    type: "git",
+    url: "https://github.com/Illusion47586/isol8.git"
+  },
+  homepage: "https://github.com/Illusion47586/isol8",
+  bugs: {
+    url: "https://github.com/Illusion47586/isol8/issues"
+  },
+  keywords: [
+    "sandbox",
+    "docker",
+    "code-execution",
+    "isolation",
+    "security",
+    "ai-agents",
+    "container",
+    "runtime"
+  ],
+  type: "module",
+  main: "./dist/index.js",
+  types: "./dist/index.d.ts",
+  exports: {
+    ".": {
+      import: "./dist/index.js",
+      types: "./dist/index.d.ts"
+    },
+    "./schema": "./schema/isol8.config.schema.json"
+  },
+  bin: {
+    isol8: "./dist/cli.js"
+  },
+  scripts: {
+    dev: "bun run src/cli.ts",
+    build: "bun run scripts/build.ts",
+    test: "bun test",
+    "lint:check": "ultracite check",
+    "lint:fix": "ultracite fix",
+    bench: "bunx tsx benchmarks/spawn.ts",
+    "bench:pool": "bunx tsx benchmarks/spawn-pool.ts",
+    "bench:detailed": "bunx tsx benchmarks/spawn-detailed.ts",
+    "docs:dev": "cd docs && mint dev",
+    "docs:validate": "cd docs && mint validate",
+    "docs:broken-links": "cd docs && mint broken-links",
+    schema: "ts-json-schema-generator --path src/types.ts --type Isol8UserConfig --tsconfig tsconfig.json -o schema/isol8.config.schema.json && ultracite fix schema/isol8.config.schema.json",
+    "publish:alpha": "bun run build && bun publish --tag alpha --access public --ignore-scripts",
+    prepare: "simple-git-hooks"
+  },
+  dependencies: {
+    commander: "^14.0.3",
+    dockerode: "^4.0.9",
+    hono: "^4.11.9",
+    ora: "^9.3.0"
+  },
+  devDependencies: {
+    "@biomejs/biome": "^2.3.15",
+    "@semantic-release/changelog": "^6.0.3",
+    "@semantic-release/git": "^10.0.1",
+    "@semantic-release/github": "^12.0.6",
+    "@semantic-release/npm": "^13.1.4",
+    "@types/bun": "latest",
+    "@types/dockerode": "^4.0.1",
+    "@types/node": "^25.2.3",
+    "lint-staged": "^16.2.7",
+    mint: "^4.2.348",
+    "semantic-release": "^25.0.3",
+    "simple-git-hooks": "^2.13.1",
+    "ts-json-schema-generator": "^2.5.0",
+    typescript: "^5.9.3",
+    ultracite: "^7.2.0"
+  },
+  files: [
+    "dist",
+    "schema",
+    "docker",
+    "README.md",
+    "LICENSE"
+  ],
+  jsonValidation: [
+    {
+      fileMatch: "isol8.config.json",
+      url: "./schema/isol8.config.schema.json"
+    }
+  ],
+  "simple-git-hooks": {
+    "pre-commit": "bun run lint-staged"
+  },
+  "lint-staged": {
+    "*.{ts,tsx}": [
+      "ultracite fix",
+      "bash -c 'bunx tsc --noEmit -p tsconfig.json'"
+    ],
+    "src/types.ts": [
+      "bash -c 'bun run schema'",
+      "git add schema/isol8.config.schema.json"
+    ]
+  }
+};
+
+// src/version.ts
+var VERSION = package_default.version;
 export {
   loadConfig,
   createServer,
   bashAdapter,
+  VERSION,
   RuntimeRegistry,
   RemoteIsol8,
   PythonAdapter,
@@ -1354,4 +1499,4 @@ export {
   BunAdapter
 };
 
-//# debugId=56FC4587DCE2E9EC64756E2164756E21
+//# debugId=50BAE19553D7B16164756E2164756E21