8d9b62daf3
This commit implements Phase 2 of the CHORUS Task Execution Engine development plan, providing a comprehensive execution environment abstraction layer with Docker container sandboxing support. ## New Features ### Core Sandbox Interface - Comprehensive ExecutionSandbox interface with isolated task execution - Support for command execution, file I/O, environment management - Resource usage monitoring and sandbox lifecycle management - Standardized error handling with SandboxError types and categories ### Docker Container Sandbox Implementation - Full Docker API integration with secure container creation - Transparent repository mounting with configurable read/write access - Advanced security policies with capability dropping and privilege controls - Comprehensive resource limits (CPU, memory, disk, processes, file handles) - Support for tmpfs mounts, masked paths, and read-only bind mounts - Container lifecycle management with proper cleanup and health monitoring ### Security & Resource Management - Configurable security policies with SELinux, AppArmor, and Seccomp support - Fine-grained capability management with secure defaults - Network isolation options with configurable DNS and proxy settings - Resource monitoring with real-time CPU, memory, and network usage tracking - Comprehensive ulimits configuration for process and file handle limits ### Repository Integration - Seamless repository mounting from local paths to container workspaces - Git configuration support with user credentials and global settings - File inclusion/exclusion patterns for selective repository access - Configurable permissions and ownership for mounted repositories ### Testing Infrastructure - Comprehensive test suite with 60+ test cases covering all functionality - Docker integration tests with Alpine Linux containers (skipped in short mode) - Mock sandbox implementation for unit testing without Docker dependencies - Security policy validation tests with read-only filesystem enforcement - Resource usage monitoring and cleanup verification tests ## Technical Details ### Dependencies Added - github.com/docker/docker v28.4.0+incompatible - Docker API client - github.com/docker/go-connections v0.6.0 - Docker connection utilities - github.com/docker/go-units v0.5.0 - Docker units and formatting - Associated Docker API dependencies for complete container management ### Architecture - Interface-driven design enabling multiple sandbox implementations - Comprehensive configuration structures for all sandbox aspects - Resource usage tracking with detailed metrics collection - Error handling with retryable error classification - Proper cleanup and resource management throughout sandbox lifecycle ### Compatibility - Maintains backward compatibility with existing CHORUS architecture - Designed for future integration with Phase 3 Core Task Execution Engine - Extensible design supporting additional sandbox implementations (VM, process) This Phase 2 implementation provides the foundation for secure, isolated task execution that will be integrated with the AI model providers from Phase 1 in the upcoming Phase 3 development. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
111 lines
7.0 KiB
Go
111 lines
7.0 KiB
Go
// Copyright 2019 The Go Authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package filedesc
|
|
|
|
import (
|
|
"google.golang.org/protobuf/internal/descopts"
|
|
"google.golang.org/protobuf/internal/pragma"
|
|
"google.golang.org/protobuf/reflect/protoreflect"
|
|
)
|
|
|
|
var (
|
|
emptyNames = new(Names)
|
|
emptyEnumRanges = new(EnumRanges)
|
|
emptyFieldRanges = new(FieldRanges)
|
|
emptyFieldNumbers = new(FieldNumbers)
|
|
emptySourceLocations = new(SourceLocations)
|
|
|
|
emptyFiles = new(FileImports)
|
|
emptyMessages = new(Messages)
|
|
emptyFields = new(Fields)
|
|
emptyOneofs = new(Oneofs)
|
|
emptyEnums = new(Enums)
|
|
emptyEnumValues = new(EnumValues)
|
|
emptyExtensions = new(Extensions)
|
|
emptyServices = new(Services)
|
|
)
|
|
|
|
// PlaceholderFile is a placeholder, representing only the file path.
|
|
type PlaceholderFile string
|
|
|
|
func (f PlaceholderFile) ParentFile() protoreflect.FileDescriptor { return f }
|
|
func (f PlaceholderFile) Parent() protoreflect.Descriptor { return nil }
|
|
func (f PlaceholderFile) Index() int { return 0 }
|
|
func (f PlaceholderFile) Syntax() protoreflect.Syntax { return 0 }
|
|
func (f PlaceholderFile) Name() protoreflect.Name { return "" }
|
|
func (f PlaceholderFile) FullName() protoreflect.FullName { return "" }
|
|
func (f PlaceholderFile) IsPlaceholder() bool { return true }
|
|
func (f PlaceholderFile) Options() protoreflect.ProtoMessage { return descopts.File }
|
|
func (f PlaceholderFile) Path() string { return string(f) }
|
|
func (f PlaceholderFile) Package() protoreflect.FullName { return "" }
|
|
func (f PlaceholderFile) Imports() protoreflect.FileImports { return emptyFiles }
|
|
func (f PlaceholderFile) Messages() protoreflect.MessageDescriptors { return emptyMessages }
|
|
func (f PlaceholderFile) Enums() protoreflect.EnumDescriptors { return emptyEnums }
|
|
func (f PlaceholderFile) Extensions() protoreflect.ExtensionDescriptors { return emptyExtensions }
|
|
func (f PlaceholderFile) Services() protoreflect.ServiceDescriptors { return emptyServices }
|
|
func (f PlaceholderFile) SourceLocations() protoreflect.SourceLocations { return emptySourceLocations }
|
|
func (f PlaceholderFile) ProtoType(protoreflect.FileDescriptor) { return }
|
|
func (f PlaceholderFile) ProtoInternal(pragma.DoNotImplement) { return }
|
|
|
|
// PlaceholderEnum is a placeholder, representing only the full name.
|
|
type PlaceholderEnum protoreflect.FullName
|
|
|
|
func (e PlaceholderEnum) ParentFile() protoreflect.FileDescriptor { return nil }
|
|
func (e PlaceholderEnum) Parent() protoreflect.Descriptor { return nil }
|
|
func (e PlaceholderEnum) Index() int { return 0 }
|
|
func (e PlaceholderEnum) Syntax() protoreflect.Syntax { return 0 }
|
|
func (e PlaceholderEnum) Name() protoreflect.Name { return protoreflect.FullName(e).Name() }
|
|
func (e PlaceholderEnum) FullName() protoreflect.FullName { return protoreflect.FullName(e) }
|
|
func (e PlaceholderEnum) IsPlaceholder() bool { return true }
|
|
func (e PlaceholderEnum) Options() protoreflect.ProtoMessage { return descopts.Enum }
|
|
func (e PlaceholderEnum) Values() protoreflect.EnumValueDescriptors { return emptyEnumValues }
|
|
func (e PlaceholderEnum) ReservedNames() protoreflect.Names { return emptyNames }
|
|
func (e PlaceholderEnum) ReservedRanges() protoreflect.EnumRanges { return emptyEnumRanges }
|
|
func (e PlaceholderEnum) IsClosed() bool { return false }
|
|
func (e PlaceholderEnum) ProtoType(protoreflect.EnumDescriptor) { return }
|
|
func (e PlaceholderEnum) ProtoInternal(pragma.DoNotImplement) { return }
|
|
|
|
// PlaceholderEnumValue is a placeholder, representing only the full name.
|
|
type PlaceholderEnumValue protoreflect.FullName
|
|
|
|
func (e PlaceholderEnumValue) ParentFile() protoreflect.FileDescriptor { return nil }
|
|
func (e PlaceholderEnumValue) Parent() protoreflect.Descriptor { return nil }
|
|
func (e PlaceholderEnumValue) Index() int { return 0 }
|
|
func (e PlaceholderEnumValue) Syntax() protoreflect.Syntax { return 0 }
|
|
func (e PlaceholderEnumValue) Name() protoreflect.Name { return protoreflect.FullName(e).Name() }
|
|
func (e PlaceholderEnumValue) FullName() protoreflect.FullName { return protoreflect.FullName(e) }
|
|
func (e PlaceholderEnumValue) IsPlaceholder() bool { return true }
|
|
func (e PlaceholderEnumValue) Options() protoreflect.ProtoMessage { return descopts.EnumValue }
|
|
func (e PlaceholderEnumValue) Number() protoreflect.EnumNumber { return 0 }
|
|
func (e PlaceholderEnumValue) ProtoType(protoreflect.EnumValueDescriptor) { return }
|
|
func (e PlaceholderEnumValue) ProtoInternal(pragma.DoNotImplement) { return }
|
|
|
|
// PlaceholderMessage is a placeholder, representing only the full name.
|
|
type PlaceholderMessage protoreflect.FullName
|
|
|
|
func (m PlaceholderMessage) ParentFile() protoreflect.FileDescriptor { return nil }
|
|
func (m PlaceholderMessage) Parent() protoreflect.Descriptor { return nil }
|
|
func (m PlaceholderMessage) Index() int { return 0 }
|
|
func (m PlaceholderMessage) Syntax() protoreflect.Syntax { return 0 }
|
|
func (m PlaceholderMessage) Name() protoreflect.Name { return protoreflect.FullName(m).Name() }
|
|
func (m PlaceholderMessage) FullName() protoreflect.FullName { return protoreflect.FullName(m) }
|
|
func (m PlaceholderMessage) IsPlaceholder() bool { return true }
|
|
func (m PlaceholderMessage) Options() protoreflect.ProtoMessage { return descopts.Message }
|
|
func (m PlaceholderMessage) IsMapEntry() bool { return false }
|
|
func (m PlaceholderMessage) Fields() protoreflect.FieldDescriptors { return emptyFields }
|
|
func (m PlaceholderMessage) Oneofs() protoreflect.OneofDescriptors { return emptyOneofs }
|
|
func (m PlaceholderMessage) ReservedNames() protoreflect.Names { return emptyNames }
|
|
func (m PlaceholderMessage) ReservedRanges() protoreflect.FieldRanges { return emptyFieldRanges }
|
|
func (m PlaceholderMessage) RequiredNumbers() protoreflect.FieldNumbers { return emptyFieldNumbers }
|
|
func (m PlaceholderMessage) ExtensionRanges() protoreflect.FieldRanges { return emptyFieldRanges }
|
|
func (m PlaceholderMessage) ExtensionRangeOptions(int) protoreflect.ProtoMessage {
|
|
panic("index out of range")
|
|
}
|
|
func (m PlaceholderMessage) Messages() protoreflect.MessageDescriptors { return emptyMessages }
|
|
func (m PlaceholderMessage) Enums() protoreflect.EnumDescriptors { return emptyEnums }
|
|
func (m PlaceholderMessage) Extensions() protoreflect.ExtensionDescriptors { return emptyExtensions }
|
|
func (m PlaceholderMessage) ProtoType(protoreflect.MessageDescriptor) { return }
|
|
func (m PlaceholderMessage) ProtoInternal(pragma.DoNotImplement) { return }
|