kern-sandbox 0.2.8 → 0.2.10

package/README.md

@@ -129,7 +129,7 @@ A non-zero exit from *your code* is **not** a fault (`fault` stays `null`): it i
 | `oom` | the kernel's OOM killer took the box against its own memory cap. Read from a descriptor the code in the box cannot write, so it is an observation and not a guess from the exit code |
 | `killed` | SIGKILL with **no** OOM reported: an external kill (`kern stop`, a signal, the host out of memory), or a cap that did not bind here, which the message names |
 | `exec_failed` | the box started, the command did not exist inside it. `{language:"node"}` on an image with no `node` is the ordinary way there; the message names the binary AND the image |
-| `startup_failed` | your `timeoutS` fired while kern was still BUILDING the box, so the code never ran. A longer timeout does not help: a bind source on a dead NFS export does this |
+| `startup_failed` | the box never ran, and kern said why in `stderr`. Two shapes: your `timeoutS` fired while kern was still BUILDING the box (run it again: a fast second call was a cold image read), or kern refused to build it at all (an image that cannot be pulled, a mount it will not make) |
 
 ```js
 const r = await kern.runCode("while True: pass", { timeoutS: 5 });

package/index.js

@@ -36,7 +36,7 @@ const crypto = require("crypto");
 const zlib = require("zlib");
 const { spawn, spawnSync } = require("child_process");
 
-const VERSION = "0.2.8";
+const VERSION = "0.2.10";
 
 const DEFAULT_IMAGE = "python:3.12-slim";
 const WORKSPACE = "/workspace"; // where the persistent workspace is mounted inside every box
@@ -446,6 +446,48 @@ const REFUSED_MOUNT_SOURCES = new Set([
   "/run/docker.sock",
 ]);
 
+/** kern's OWN state on this host: [path, what it is]. Refused as a mount source, like the docker socket
+ * and for the same reason.
+ *
+ * FOUND BY A CHECKLIST ROW, measured on the Python binding first: mounting `$XDG_RUNTIME_DIR/kern` was
+ * ACCEPTED, which hands the code in the box kern's control plane (the registry, instance dirs, netns
+ * handles and exit files of every box this user runs). The image cache is the same class one step
+ * removed: a box that writes it poisons the rootfs a LATER box runs. Resolved per call, because these
+ * follow the environment and a service manager moves them. */
+function kernStateDirs() {
+  const uid = process.getuid();
+  const runtime = process.env.XDG_RUNTIME_DIR || `/run/user/${uid}`;
+  const home = os.homedir();
+  const cache = process.env.XDG_CACHE_HOME || path.join(home, ".cache");
+  const config = process.env.XDG_CONFIG_HOME || path.join(home, ".config");
+  return [
+    [path.join(runtime, "kern"), "kern's runtime state (the registry, instance dirs, netns handles and exit files of every box you are running)"],
+    [`/run/user/${uid}/kern`, "kern's runtime state"],
+    [path.join(cache, "kern"), "kern's image cache (a box that writes it poisons the rootfs a later box runs)"],
+    [path.join(config, "kern"), "kern's configuration (the profiles a later box may be given)"],
+  ];
+}
+
+/** Credential directories, refused as a COMPONENT anywhere in the source. The set above is absolute
+ * paths, so it refused `$HOME` and accepted `$HOME/.ssh`: MEASURED, a box mounted with `~/.ssh` listed
+ * `id_ed25519` and `authorized_keys`. Refusing the parent and allowing its most sensitive child is the
+ * wrong way round, and it is the scenario a prompt-injected agent is steered into ("read ~/.aws"). These
+ * match by NAME because they live under a per-user home. No escape hatch, same as `/etc`: a job that
+ * needs one credential should be given that one file in the workspace. */
+const REFUSED_MOUNT_COMPONENTS = new Set([
+  ".ssh",
+  ".aws",
+  ".gnupg",
+  ".kube",
+  ".docker",
+  ".azure",
+  ".password-store",
+  ".netrc",
+  ".git-credentials",
+  ".pypirc",
+  ".npmrc",
+]);
+
 /** A PROGRAMMER/config error, THROWN: bad argument, illegal mount, `kern` not installed, or the box
  * FAILED TO START (kern exits 125 - a mount refused at runtime, an unmappable `--user`, a seccomp or
  * AppArmor setup error). A box that never started ran no user code, so it rejects rather than resolve a
@@ -837,6 +879,23 @@ function validateMount(source, target) {
       `refusing to mount the sensitive host path ${JSON.stringify(real)} into a sandbox ` +
         "(this would defeat the isolation)",
     );
+  for (const [state, what] of kernStateDirs()) {
+    let sreal;
+    try { sreal = fs.realpathSync(state); } catch { sreal = state; }
+    if (real === sreal || real.startsWith(sreal + path.sep))
+      throw new MountRefused(
+        `refusing to mount ${JSON.stringify(real)}: it is ${what}. Mounting kern's own state into a box ` +
+          "it started gives the code inside the sandbox's control plane, which is the same reason the " +
+          "docker socket is refused",
+      );
+  }
+  for (const part of real.split(path.sep))
+    if (REFUSED_MOUNT_COMPONENTS.has(part))
+      throw new MountRefused(
+        `refusing to mount ${JSON.stringify(real)}: ${JSON.stringify(part)} holds credentials, and code ` +
+          "in the box would read them. If the job needs one secret, write THAT FILE into the workspace " +
+          "(sbx.writeFile) or mount a directory that holds only it",
+      );
   return [real, target];
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kern-sandbox",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "kern is a fast, rootless sandbox and virtual resource runtime for any workload, including untrusted and AI-generated code; kern-sandbox is its Node/TypeScript binding. Run untrusted or agent-generated code (Python/JS/Bash) in a real, kernel-enforced box in single-digit milliseconds, with no cloud, no account and no VM.",
   "keywords": [
     "sandbox",