kern-sandbox 0.1.9 → 0.1.11
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +3 -3
- package/index.js +1 -1
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
# kern-sandbox (Node.js / TypeScript)
|
|
2
2
|
|
|
3
3
|
**[kern](https://github.com/getkern/kern)** is a fast, rootless, daemonless Linux sandbox runtime: a real,
|
|
4
|
-
kernel-enforced box that starts in **~2 ms**, from one **~1.
|
|
4
|
+
kernel-enforced box that starts in **~2.3 ms**, from one **~1.8 MB** binary, with no daemon. **kern-sandbox**
|
|
5
5
|
is its Node / TypeScript binding: run untrusted or agent-generated code in a fresh, isolated box, from Node.
|
|
6
6
|
|
|
7
7
|
On npm: [`npm install kern-sandbox`](https://www.npmjs.com/package/kern-sandbox). For Python, the same
|
|
@@ -9,7 +9,7 @@ package is on PyPI: [`kern-sandbox`](https://pypi.org/project/kern-sandbox/).
|
|
|
9
9
|
|
|
10
10
|
It is a thin, dependency-free wrapper around the [`kern`](https://github.com/getkern/kern) binary:
|
|
11
11
|
a fresh, isolated box per call, network off by default, hard resource caps, and a timeout the binding
|
|
12
|
-
itself enforces. Kernel-enforced isolation (namespaces, cgroups v2, seccomp), local, about 1.
|
|
12
|
+
itself enforces. Kernel-enforced isolation (namespaces, cgroups v2, seccomp), local, about 1.8 MB, with no cloud, no account, no VM.
|
|
13
13
|
|
|
14
14
|
```js
|
|
15
15
|
const kern = require("kern-sandbox");
|
|
@@ -136,7 +136,7 @@ new Sandbox({
|
|
|
136
136
|
profiles, // reusable kern.toml profiles: ["vcpu:heavy", "vgpio:leds", "vdisk:scratch"]
|
|
137
137
|
env, // { KEY: "value" }
|
|
138
138
|
maxOutputBytes, // default 64 MiB
|
|
139
|
-
enforceLimits, // default true
|
|
139
|
+
enforceLimits, // default true; false is best-effort and NO faster (see the Python README)
|
|
140
140
|
depsReadonly, // default false
|
|
141
141
|
trackFiles, // default true: diff the workspace each call for result.files (O(files)); false = [], O(1)
|
|
142
142
|
onStdout, // (chunk: Buffer) => void, live stdout streaming (result.stdout still captured)
|
package/index.js
CHANGED
|
@@ -36,7 +36,7 @@ const crypto = require("crypto");
|
|
|
36
36
|
const zlib = require("zlib");
|
|
37
37
|
const { spawn, spawnSync } = require("child_process");
|
|
38
38
|
|
|
39
|
-
const VERSION = "0.1.
|
|
39
|
+
const VERSION = "0.1.11";
|
|
40
40
|
|
|
41
41
|
const DEFAULT_IMAGE = "python:3.12-slim";
|
|
42
42
|
const WORKSPACE = "/workspace"; // where the persistent workspace is mounted inside every box
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "kern-sandbox",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.11",
|
|
4
4
|
"description": "kern is a fast, rootless, daemonless Linux sandbox runtime; kern-sandbox is its Node/TypeScript binding. Run untrusted or agent-generated code (Python/JS/Bash) in a real, kernel-enforced box, ~2 ms, no cloud, no account, no VM.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"sandbox",
|
|
@@ -18,7 +18,7 @@
|
|
|
18
18
|
"homepage": "https://github.com/getkern/kern/tree/main/bindings/node",
|
|
19
19
|
"repository": {
|
|
20
20
|
"type": "git",
|
|
21
|
-
"url": "https://github.com/getkern/kern.git",
|
|
21
|
+
"url": "git+https://github.com/getkern/kern.git",
|
|
22
22
|
"directory": "bindings/node"
|
|
23
23
|
},
|
|
24
24
|
"bugs": {
|