xqo-docker 3.0.0__py3-none-any.whl

xqo_docker/__init__.py

@@ -0,0 +1,25 @@
+"""xqo-docker: the "docker" sandbox backend for run_code (throwaway containers, no network unless granted,
+toolchain images). With it installed, "sandbox": {"backend": "auto"} picks Docker when the daemon answers; without it
+(or with "plugins": {"disable": ["docker"]}) runs use the local backend."""
+from __future__ import annotations
+
+import importlib
+
+from xqo.api import Plugin, docker_available
+
+__version__ = "3.0.0"
+
+
+class DockerPlugin(Plugin):
+    name = "docker"
+    description = "Docker sandbox backend for run_code"
+
+    @classmethod
+    def register(cls) -> None:
+        importlib.import_module(f"{__name__}.backend")  # registers "docker" with register_backend
+
+    def configure(self, ctx, cfg):
+        return {"backend": "docker"}
+
+    def status(self) -> dict:
+        return {**self.obj, "daemon": docker_available()}

xqo_docker/backend.py

@@ -0,0 +1,123 @@
+"""Docker sandbox backend (plugin): throwaway containers for run_code, with toolchain images and offline runs.
+The core keeps the `local` backend and the shared run/venv machinery."""
+from __future__ import annotations
+
+import asyncio
+import os
+import uuid
+from pathlib import Path, PurePosixPath
+
+from xqo.api import (DOCKER_PATH, Backend, Sandbox, current_toolchains, docker_available, docker_kill, docker_user,
+                     is_python_project, mount_hint, net_args, register_backend, setup_net_args, uv_pip_command)
+
+@register_backend
+class DockerBackend(Backend):
+    """A throwaway container: no network, memory/CPU/pid limits, the host user's uid. Python projects get a uv venv;
+    Node/Go/Rust/.NET projects run in their official image (at the version the project asks for), and mixed projects
+    in a composite image built once. Dependencies are installed by setup containers (network on, `setup_network`)
+    into the task's .deps-docker dir and shared download caches, which runs mount instead of copying."""
+    name = "docker"
+    toolchains = True
+    isolates_network = True
+
+    def available(self) -> bool:
+        return docker_available()
+
+    async def command(self, sb, work, command, env_dir, comps, network=False):
+        cfg, res, run_cmd = sb.config, {}, command
+        image, mounts, env = cfg.image, [], {}
+        toolchains = current_toolchains()  # the toolchains plugin, or None
+        if toolchains and env_dir is not None and cfg.toolchains and any(c.kind != "python" for c in comps):
+            plan = toolchains.docker_plan(work, comps, cfg)
+            image = plan["image"]
+            info = {"kind": "image", "image": image, "tools": plan["tools"]}
+            if plan["dockerfile"]:
+                built = await sb.build_image(image, plan["dockerfile"], env_dir.parent / ".deps-docker")
+                info.update(built)
+            res["toolchains"] = [info]
+            if not info.get("error"):
+                deps = env_dir.parent / ".deps-docker"
+                runner = DockerRunner(sb, image, work, deps, toolchains.cache_root(cfg.cache_dir) / "docker")
+                prep = await toolchains.prepare(runner, work, comps, deps, cfg, {"HOME": "/tmp"})
+                res["toolchains"] += prep.info
+                env = {**prep.env, **({} if network or cfg.network else DOCKER_RUN_OFFLINE)}
+                mounts = runner.mounts()
+                if prep.managed and (note := toolchains.install_note(command)):
+                    res["notes"] = [note]
+        container = f"orch-run-{uuid.uuid4().hex[:12]}"  # named, so a cancel can kill it
+        argv = ["docker", "run", "--rm", "-i", "--name", container, "--memory", cfg.memory, "--cpus", cfg.cpus,
+                "--pids-limit", "256", *docker_user(), "-v", f"{work}:/work", *mounts, "-w", "/work",
+                "-e", "HOME=/tmp"]
+        argv += [x for k, v in env.items() if k != "HOME" for x in ("-e", f"{k}={v}")]
+        if env_dir is not None and cfg.venv and is_python_project(work):
+            denv = env_dir.with_name(env_dir.name + "-docker")
+            venv = await sb.prepare_docker_env(work, denv, image)
+            res["venv"] = venv
+            if not venv.get("error"):  # run inside the task's venv; uv run/sync use it too
+                argv += ["-v", f"{denv}:/venv", "-e", "VIRTUAL_ENV=/venv/env", "-e", "UV_PROJECT_ENVIRONMENT=/venv/env",
+                         "-e", "UV_CACHE_DIR=/venv/cache", "-e", "UV_PYTHON_INSTALL_DIR=/venv/python",
+                         "-e", f"PATH=/venv/env/bin:{DOCKER_PATH}"]
+                run_cmd = uv_pip_command(command)
+        if network:  # approved by the user for this run: the host's CA and proxies, like setup containers
+            argv += net_args(cfg)
+        elif not cfg.network:
+            argv += ["--network", "none"]
+        argv += [image, "sh", "-c", run_cmd]
+        return {"argv": argv, "env": None, "run_cmd": run_cmd, "container": container, "result": res}
+
+
+# runs have no network: tools fail fast instead of trying to download
+DOCKER_RUN_OFFLINE = {"GOPROXY": "off", "GOTOOLCHAIN": "local", "CARGO_NET_OFFLINE": "true",
+                      "npm_config_prefer_offline": "true"}
+
+
+class DockerRunner:
+    """toolchains.prepare's setup commands, each in a throwaway container of the run's image: the run copy at /work,
+    the task's deps at /deps, the shared download caches at /cache; network on unless setup_network is false."""
+    versions = False   # the image is the version
+    host_env = False
+
+    def __init__(self, sb: "Sandbox", image: str, work: Path, deps: Path, cache: Path):
+        self.sb, self.image, self.work, self.deps, self.cache = sb, image, work, deps, cache
+        deps.mkdir(parents=True, exist_ok=True)  # made by us, not by Docker (it would make them root's)
+        cache.mkdir(parents=True, exist_ok=True)
+
+    def deps_view(self, deps: Path):
+        return PurePosixPath("/deps")
+
+    def mounts(self) -> list[str]:
+        return ["-v", f"{self.deps}:/deps", "-v", f"{self.cache}:/cache"]
+
+    def where(self, p: Path) -> str:
+        """A host path under the run copy or the deps dir, as the container sees it."""
+        for host, ctr in ((self.work, "/work"), (self.deps, "/deps")):
+            try:
+                return (PurePosixPath(ctr) / p.relative_to(host).as_posix()).as_posix()
+            except ValueError:
+                pass
+        raise ValueError(f"{p} is not mounted")
+
+    def exe(self, argv: list[str], env: dict) -> list[str]:
+        return ["corepack", *argv] if argv[0] in ("pnpm", "yarn") else argv  # node images ship corepack
+
+    def link(self, target: Path, link: Path) -> None:
+        os.symlink(self.where(target), link, target_is_directory=True)  # dangling on the host, valid inside
+
+    async def sh(self, argv, cwd: Path, env: dict, timeout: float):
+        cfg = self.sb.config
+        name = f"orch-setup-{uuid.uuid4().hex[:12]}"
+        dargv = ["docker", "run", "--rm", "-i", "--name", name, "--memory", cfg.memory, "--cpus", cfg.cpus,
+                 "--pids-limit", "512", *docker_user(), "-v", f"{self.work}:/work", *self.mounts(),
+                 *setup_net_args(cfg), "-w", self.where(cwd),
+                 *[x for k, v in env.items() for x in ("-e", f"{k}={v}")]]
+        if not cfg.setup_network:
+            dargv += ["--network", "none"]
+        try:
+            code, out = await self.sb._sh([*dargv, self.image, *argv], self.work, dict(os.environ), timeout)
+        except asyncio.CancelledError:
+            await docker_kill(name)
+            raise
+        if code == -1:
+            await docker_kill(name)
+        return code, (mount_hint(out) + "\n" + out) if code == 125 and mount_hint(out) else out
+

xqo_docker-3.0.0.dist-info/METADATA

@@ -0,0 +1,37 @@
+Metadata-Version: 2.4
+Name: xqo-docker
+Version: 3.0.0
+Summary: Docker sandbox backend for xqo run_code
+Author: dudikkocak
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/dudikkocak/xqo
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: xqo<4,>=3.0
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: pytest-timeout>=2.3; extra == "dev"
+Dynamic: license-file
+
+# xqo-docker
+
+The `docker` sandbox backend for [xqo](https://github.com/dudikkocak/xqo)'s `run_code`: each run happens in a
+throwaway container with no network (unless the user grants it), memory, CPU and process limits, and the host
+user's uid. Python projects get a uv venv inside the image; Node, Go, Rust and .NET projects use their official
+images when the toolchains plugin is installed.
+
+```bash
+pip install xqo-docker
+```
+
+```json
+"sandbox": {"backend": "docker"}
+```
+
+With the plugin installed, `"backend": "auto"` picks Docker whenever the daemon answers and falls back to `local`
+otherwise. `"plugins": {"disable": ["docker"]}` turns it off without uninstalling. `/api/plugins` shows whether the
+daemon answered (`status.daemon`).
+
+Needs the `docker` CLI and a running daemon (Docker Desktop, Docker Engine or a compatible one). The image is set
+with `sandbox.image` (default `astral/uv:python3.12-bookworm-slim`); it needs `uv` and `python` on its PATH.

xqo_docker-3.0.0.dist-info/RECORD

@@ -0,0 +1,8 @@
+xqo_docker/__init__.py,sha256=kWTgCrG4eSonCvYgEkpDTUCV6xK0AQPVmf2tW-YnBWU,839
+xqo_docker/backend.py,sha256=8GATXfkdAGv3WqwT-4S7NznpZlvucn4Vmk5AOmcMCxI,6716
+xqo_docker-3.0.0.dist-info/licenses/LICENSE,sha256=PHtf4TI2P6oulwhOKBF8SgeOkDLp9YnLdq46mw6506s,1067
+xqo_docker-3.0.0.dist-info/METADATA,sha256=BaSG7P6YWcOiZTC7R8qWYSSvP0CAHvz2EYN6DyAiPzI,1417
+xqo_docker-3.0.0.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+xqo_docker-3.0.0.dist-info/entry_points.txt,sha256=zzjBST_E3BZZOzSKKl8Br36CQBX6ELvxtxVkhfmCgRM,47
+xqo_docker-3.0.0.dist-info/top_level.txt,sha256=w3urj2YYpNGAHWZ5UdpVrfmD7BI3dl09Zui_GjKmisc,11
+xqo_docker-3.0.0.dist-info/RECORD,,

xqo_docker-3.0.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.2.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

xqo_docker-3.0.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[xqo.plugins]
+docker = xqo_docker:DockerPlugin

xqo_docker-3.0.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dudikkocak
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

xqo_docker-3.0.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+xqo_docker