8d9b62daf3
This commit implements Phase 2 of the CHORUS Task Execution Engine development plan, providing a comprehensive execution environment abstraction layer with Docker container sandboxing support. ## New Features ### Core Sandbox Interface - Comprehensive ExecutionSandbox interface with isolated task execution - Support for command execution, file I/O, environment management - Resource usage monitoring and sandbox lifecycle management - Standardized error handling with SandboxError types and categories ### Docker Container Sandbox Implementation - Full Docker API integration with secure container creation - Transparent repository mounting with configurable read/write access - Advanced security policies with capability dropping and privilege controls - Comprehensive resource limits (CPU, memory, disk, processes, file handles) - Support for tmpfs mounts, masked paths, and read-only bind mounts - Container lifecycle management with proper cleanup and health monitoring ### Security & Resource Management - Configurable security policies with SELinux, AppArmor, and Seccomp support - Fine-grained capability management with secure defaults - Network isolation options with configurable DNS and proxy settings - Resource monitoring with real-time CPU, memory, and network usage tracking - Comprehensive ulimits configuration for process and file handle limits ### Repository Integration - Seamless repository mounting from local paths to container workspaces - Git configuration support with user credentials and global settings - File inclusion/exclusion patterns for selective repository access - Configurable permissions and ownership for mounted repositories ### Testing Infrastructure - Comprehensive test suite with 60+ test cases covering all functionality - Docker integration tests with Alpine Linux containers (skipped in short mode) - Mock sandbox implementation for unit testing without Docker dependencies - Security policy validation tests with read-only filesystem enforcement - Resource usage monitoring and cleanup verification tests ## Technical Details ### Dependencies Added - github.com/docker/docker v28.4.0+incompatible - Docker API client - github.com/docker/go-connections v0.6.0 - Docker connection utilities - github.com/docker/go-units v0.5.0 - Docker units and formatting - Associated Docker API dependencies for complete container management ### Architecture - Interface-driven design enabling multiple sandbox implementations - Comprehensive configuration structures for all sandbox aspects - Resource usage tracking with detailed metrics collection - Error handling with retryable error classification - Proper cleanup and resource management throughout sandbox lifecycle ### Compatibility - Maintains backward compatibility with existing CHORUS architecture - Designed for future integration with Phase 3 Core Task Execution Engine - Extensible design supporting additional sandbox implementations (VM, process) This Phase 2 implementation provides the foundation for secure, isolated task execution that will be integrated with the AI model providers from Phase 1 in the upcoming Phase 3 development. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
59 lines
1.7 KiB
Go
59 lines
1.7 KiB
Go
// Copyright 2018 The Go Authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
// The protoc-gen-go binary is a protoc plugin to generate Go code for
|
|
// both proto2 and proto3 versions of the protocol buffer language.
|
|
//
|
|
// For more information about the usage of this plugin, see:
|
|
// https://protobuf.dev/reference/go/go-generated.
|
|
package main
|
|
|
|
import (
|
|
"errors"
|
|
"flag"
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
|
|
gengo "google.golang.org/protobuf/cmd/protoc-gen-go/internal_gengo"
|
|
"google.golang.org/protobuf/compiler/protogen"
|
|
"google.golang.org/protobuf/internal/version"
|
|
)
|
|
|
|
const genGoDocURL = "https://protobuf.dev/reference/go/go-generated"
|
|
const grpcDocURL = "https://grpc.io/docs/languages/go/quickstart/#regenerate-grpc-code"
|
|
|
|
func main() {
|
|
if len(os.Args) == 2 && os.Args[1] == "--version" {
|
|
fmt.Fprintf(os.Stdout, "%v %v\n", filepath.Base(os.Args[0]), version.String())
|
|
os.Exit(0)
|
|
}
|
|
if len(os.Args) == 2 && os.Args[1] == "--help" {
|
|
fmt.Fprintf(os.Stdout, "See "+genGoDocURL+" for usage information.\n")
|
|
os.Exit(0)
|
|
}
|
|
|
|
var (
|
|
flags flag.FlagSet
|
|
plugins = flags.String("plugins", "", "deprecated option")
|
|
)
|
|
protogen.Options{
|
|
ParamFunc: flags.Set,
|
|
}.Run(func(gen *protogen.Plugin) error {
|
|
if *plugins != "" {
|
|
return errors.New("protoc-gen-go: plugins are not supported; use 'protoc --go-grpc_out=...' to generate gRPC\n\n" +
|
|
"See " + grpcDocURL + " for more information.")
|
|
}
|
|
for _, f := range gen.Files {
|
|
if f.Generate {
|
|
gengo.GenerateFile(gen, f)
|
|
}
|
|
}
|
|
gen.SupportedFeatures = gengo.SupportedFeatures
|
|
gen.SupportedEditionsMinimum = gengo.SupportedEditionsMinimum
|
|
gen.SupportedEditionsMaximum = gengo.SupportedEditionsMaximum
|
|
return nil
|
|
})
|
|
}
|