This commit implements Phase 2 of the CHORUS Task Execution Engine development plan, providing a comprehensive execution environment abstraction layer with Docker container sandboxing support. ## New Features ### Core Sandbox Interface - Comprehensive ExecutionSandbox interface with isolated task execution - Support for command execution, file I/O, environment management - Resource usage monitoring and sandbox lifecycle management - Standardized error handling with SandboxError types and categories ### Docker Container Sandbox Implementation - Full Docker API integration with secure container creation - Transparent repository mounting with configurable read/write access - Advanced security policies with capability dropping and privilege controls - Comprehensive resource limits (CPU, memory, disk, processes, file handles) - Support for tmpfs mounts, masked paths, and read-only bind mounts - Container lifecycle management with proper cleanup and health monitoring ### Security & Resource Management - Configurable security policies with SELinux, AppArmor, and Seccomp support - Fine-grained capability management with secure defaults - Network isolation options with configurable DNS and proxy settings - Resource monitoring with real-time CPU, memory, and network usage tracking - Comprehensive ulimits configuration for process and file handle limits ### Repository Integration - Seamless repository mounting from local paths to container workspaces - Git configuration support with user credentials and global settings - File inclusion/exclusion patterns for selective repository access - Configurable permissions and ownership for mounted repositories ### Testing Infrastructure - Comprehensive test suite with 60+ test cases covering all functionality - Docker integration tests with Alpine Linux containers (skipped in short mode) - Mock sandbox implementation for unit testing without Docker dependencies - Security policy validation tests with read-only filesystem enforcement - Resource usage monitoring and cleanup verification tests ## Technical Details ### Dependencies Added - github.com/docker/docker v28.4.0+incompatible - Docker API client - github.com/docker/go-connections v0.6.0 - Docker connection utilities - github.com/docker/go-units v0.5.0 - Docker units and formatting - Associated Docker API dependencies for complete container management ### Architecture - Interface-driven design enabling multiple sandbox implementations - Comprehensive configuration structures for all sandbox aspects - Resource usage tracking with detailed metrics collection - Error handling with retryable error classification - Proper cleanup and resource management throughout sandbox lifecycle ### Compatibility - Maintains backward compatibility with existing CHORUS architecture - Designed for future integration with Phase 3 Core Task Execution Engine - Extensible design supporting additional sandbox implementations (VM, process) This Phase 2 implementation provides the foundation for secure, isolated task execution that will be integrated with the AI model providers from Phase 1 in the upcoming Phase 3 development. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
261 lines
7.3 KiB
YAML
261 lines
7.3 KiB
YAML
version: "2"
|
|
run:
|
|
issues-exit-code: 1
|
|
tests: true
|
|
linters:
|
|
default: none
|
|
enable:
|
|
- asasalint
|
|
- bodyclose
|
|
- depguard
|
|
- errcheck
|
|
- errorlint
|
|
- gocritic
|
|
- godot
|
|
- gosec
|
|
- govet
|
|
- ineffassign
|
|
- misspell
|
|
- perfsprint
|
|
- revive
|
|
- staticcheck
|
|
- testifylint
|
|
- unconvert
|
|
- unparam
|
|
- unused
|
|
- usestdlibvars
|
|
- usetesting
|
|
settings:
|
|
depguard:
|
|
rules:
|
|
auto/sdk:
|
|
files:
|
|
- '!internal/global/trace.go'
|
|
- ~internal/global/trace_test.go
|
|
deny:
|
|
- pkg: go.opentelemetry.io/auto/sdk
|
|
desc: Do not use SDK from automatic instrumentation.
|
|
non-tests:
|
|
files:
|
|
- '!$test'
|
|
- '!**/*test/*.go'
|
|
- '!**/internal/matchers/*.go'
|
|
deny:
|
|
- pkg: testing
|
|
- pkg: github.com/stretchr/testify
|
|
- pkg: crypto/md5
|
|
- pkg: crypto/sha1
|
|
- pkg: crypto/**/pkix
|
|
otel-internal:
|
|
files:
|
|
- '**/sdk/*.go'
|
|
- '**/sdk/**/*.go'
|
|
- '**/exporters/*.go'
|
|
- '**/exporters/**/*.go'
|
|
- '**/schema/*.go'
|
|
- '**/schema/**/*.go'
|
|
- '**/metric/*.go'
|
|
- '**/metric/**/*.go'
|
|
- '**/bridge/*.go'
|
|
- '**/bridge/**/*.go'
|
|
- '**/trace/*.go'
|
|
- '**/trace/**/*.go'
|
|
- '**/log/*.go'
|
|
- '**/log/**/*.go'
|
|
deny:
|
|
- pkg: go.opentelemetry.io/otel/internal$
|
|
desc: Do not use cross-module internal packages.
|
|
- pkg: go.opentelemetry.io/otel/internal/internaltest
|
|
desc: Do not use cross-module internal packages.
|
|
otlp-internal:
|
|
files:
|
|
- '!**/exporters/otlp/internal/**/*.go'
|
|
deny:
|
|
- pkg: go.opentelemetry.io/otel/exporters/otlp/internal
|
|
desc: Do not use cross-module internal packages.
|
|
otlpmetric-internal:
|
|
files:
|
|
- '!**/exporters/otlp/otlpmetric/internal/*.go'
|
|
- '!**/exporters/otlp/otlpmetric/internal/**/*.go'
|
|
deny:
|
|
- pkg: go.opentelemetry.io/otel/exporters/otlp/otlpmetric/internal
|
|
desc: Do not use cross-module internal packages.
|
|
otlptrace-internal:
|
|
files:
|
|
- '!**/exporters/otlp/otlptrace/*.go'
|
|
- '!**/exporters/otlp/otlptrace/internal/**.go'
|
|
deny:
|
|
- pkg: go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal
|
|
desc: Do not use cross-module internal packages.
|
|
gocritic:
|
|
disabled-checks:
|
|
- appendAssign
|
|
- commentedOutCode
|
|
- dupArg
|
|
- hugeParam
|
|
- importShadow
|
|
- preferDecodeRune
|
|
- rangeValCopy
|
|
- unnamedResult
|
|
- whyNoLint
|
|
enable-all: true
|
|
godot:
|
|
exclude:
|
|
# Exclude links.
|
|
- '^ *\[[^]]+\]:'
|
|
# Exclude sentence fragments for lists.
|
|
- ^[ ]*[-•]
|
|
# Exclude sentences prefixing a list.
|
|
- :$
|
|
misspell:
|
|
locale: US
|
|
ignore-rules:
|
|
- cancelled
|
|
perfsprint:
|
|
int-conversion: true
|
|
err-error: true
|
|
errorf: true
|
|
sprintf1: true
|
|
strconcat: true
|
|
revive:
|
|
confidence: 0.01
|
|
rules:
|
|
- name: blank-imports
|
|
- name: bool-literal-in-expr
|
|
- name: constant-logical-expr
|
|
- name: context-as-argument
|
|
arguments:
|
|
- allowTypesBefore: '*testing.T'
|
|
disabled: true
|
|
- name: context-keys-type
|
|
- name: deep-exit
|
|
- name: defer
|
|
arguments:
|
|
- - call-chain
|
|
- loop
|
|
- name: dot-imports
|
|
- name: duplicated-imports
|
|
- name: early-return
|
|
arguments:
|
|
- preserveScope
|
|
- name: empty-block
|
|
- name: empty-lines
|
|
- name: error-naming
|
|
- name: error-return
|
|
- name: error-strings
|
|
- name: errorf
|
|
- name: exported
|
|
arguments:
|
|
- sayRepetitiveInsteadOfStutters
|
|
- name: flag-parameter
|
|
- name: identical-branches
|
|
- name: if-return
|
|
- name: import-shadowing
|
|
- name: increment-decrement
|
|
- name: indent-error-flow
|
|
arguments:
|
|
- preserveScope
|
|
- name: package-comments
|
|
- name: range
|
|
- name: range-val-in-closure
|
|
- name: range-val-address
|
|
- name: redefines-builtin-id
|
|
- name: string-format
|
|
arguments:
|
|
- - panic
|
|
- /^[^\n]*$/
|
|
- must not contain line breaks
|
|
- name: struct-tag
|
|
- name: superfluous-else
|
|
arguments:
|
|
- preserveScope
|
|
- name: time-equal
|
|
- name: unconditional-recursion
|
|
- name: unexported-return
|
|
- name: unhandled-error
|
|
arguments:
|
|
- fmt.Fprint
|
|
- fmt.Fprintf
|
|
- fmt.Fprintln
|
|
- fmt.Print
|
|
- fmt.Printf
|
|
- fmt.Println
|
|
- name: unused-parameter
|
|
- name: unused-receiver
|
|
- name: unnecessary-stmt
|
|
- name: use-any
|
|
- name: useless-break
|
|
- name: var-declaration
|
|
- name: var-naming
|
|
arguments:
|
|
- ["ID"] # AllowList
|
|
- ["Otel", "Aws", "Gcp"] # DenyList
|
|
- name: waitgroup-by-value
|
|
testifylint:
|
|
enable-all: true
|
|
disable:
|
|
- float-compare
|
|
- go-require
|
|
- require-error
|
|
exclusions:
|
|
generated: lax
|
|
presets:
|
|
- common-false-positives
|
|
- legacy
|
|
- std-error-handling
|
|
rules:
|
|
- linters:
|
|
- revive
|
|
path: schema/v.*/types/.*
|
|
text: avoid meaningless package names
|
|
# TODO: Having appropriate comments for exported objects helps development,
|
|
# even for objects in internal packages. Appropriate comments for all
|
|
# exported objects should be added and this exclusion removed.
|
|
- linters:
|
|
- revive
|
|
path: .*internal/.*
|
|
text: exported (method|function|type|const) (.+) should have comment or be unexported
|
|
# Yes, they are, but it's okay in a test.
|
|
- linters:
|
|
- revive
|
|
path: _test\.go
|
|
text: exported func.*returns unexported type.*which can be annoying to use
|
|
# Example test functions should be treated like main.
|
|
- linters:
|
|
- revive
|
|
path: example.*_test\.go
|
|
text: calls to (.+) only in main[(][)] or init[(][)] functions
|
|
# It's okay to not run gosec and perfsprint in a test.
|
|
- linters:
|
|
- gosec
|
|
- perfsprint
|
|
path: _test\.go
|
|
# Ignoring gosec G404: Use of weak random number generator (math/rand instead of crypto/rand)
|
|
# as we commonly use it in tests and examples.
|
|
- linters:
|
|
- gosec
|
|
text: 'G404:'
|
|
# Ignoring gosec G402: TLS MinVersion too low
|
|
# as the https://pkg.go.dev/crypto/tls#Config handles MinVersion default well.
|
|
- linters:
|
|
- gosec
|
|
text: 'G402: TLS MinVersion too low.'
|
|
issues:
|
|
max-issues-per-linter: 0
|
|
max-same-issues: 0
|
|
formatters:
|
|
enable:
|
|
- gofumpt
|
|
- goimports
|
|
- golines
|
|
settings:
|
|
gofumpt:
|
|
extra-rules: true
|
|
goimports:
|
|
local-prefixes:
|
|
- go.opentelemetry.io/otel
|
|
golines:
|
|
max-len: 120
|
|
exclusions:
|
|
generated: lax
|