 8d9b62daf3
			
		
	
	8d9b62daf3
	
	
	
		
			
			This commit implements Phase 2 of the CHORUS Task Execution Engine development plan, providing a comprehensive execution environment abstraction layer with Docker container sandboxing support. ## New Features ### Core Sandbox Interface - Comprehensive ExecutionSandbox interface with isolated task execution - Support for command execution, file I/O, environment management - Resource usage monitoring and sandbox lifecycle management - Standardized error handling with SandboxError types and categories ### Docker Container Sandbox Implementation - Full Docker API integration with secure container creation - Transparent repository mounting with configurable read/write access - Advanced security policies with capability dropping and privilege controls - Comprehensive resource limits (CPU, memory, disk, processes, file handles) - Support for tmpfs mounts, masked paths, and read-only bind mounts - Container lifecycle management with proper cleanup and health monitoring ### Security & Resource Management - Configurable security policies with SELinux, AppArmor, and Seccomp support - Fine-grained capability management with secure defaults - Network isolation options with configurable DNS and proxy settings - Resource monitoring with real-time CPU, memory, and network usage tracking - Comprehensive ulimits configuration for process and file handle limits ### Repository Integration - Seamless repository mounting from local paths to container workspaces - Git configuration support with user credentials and global settings - File inclusion/exclusion patterns for selective repository access - Configurable permissions and ownership for mounted repositories ### Testing Infrastructure - Comprehensive test suite with 60+ test cases covering all functionality - Docker integration tests with Alpine Linux containers (skipped in short mode) - Mock sandbox implementation for unit testing without Docker dependencies - Security policy validation tests with read-only filesystem enforcement - Resource usage monitoring and cleanup verification tests ## Technical Details ### Dependencies Added - github.com/docker/docker v28.4.0+incompatible - Docker API client - github.com/docker/go-connections v0.6.0 - Docker connection utilities - github.com/docker/go-units v0.5.0 - Docker units and formatting - Associated Docker API dependencies for complete container management ### Architecture - Interface-driven design enabling multiple sandbox implementations - Comprehensive configuration structures for all sandbox aspects - Resource usage tracking with detailed metrics collection - Error handling with retryable error classification - Proper cleanup and resource management throughout sandbox lifecycle ### Compatibility - Maintains backward compatibility with existing CHORUS architecture - Designed for future integration with Phase 3 Core Task Execution Engine - Extensible design supporting additional sandbox implementations (VM, process) This Phase 2 implementation provides the foundation for secure, isolated task execution that will be integrated with the AI model providers from Phase 1 in the upcoming Phase 3 development. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
		
			
				
	
	
		
			233 lines
		
	
	
		
			6.6 KiB
		
	
	
	
		
			Go
		
	
	
	
	
	
			
		
		
	
	
			233 lines
		
	
	
		
			6.6 KiB
		
	
	
	
		
			Go
		
	
	
	
	
	
| // Copyright The OpenTelemetry Authors
 | |
| // SPDX-License-Identifier: Apache-2.0
 | |
| 
 | |
| package global // import "go.opentelemetry.io/otel/internal/global"
 | |
| 
 | |
| /*
 | |
| This file contains the forwarding implementation of the TracerProvider used as
 | |
| the default global instance. Prior to initialization of an SDK, Tracers
 | |
| returned by the global TracerProvider will provide no-op functionality. This
 | |
| means that all Span created prior to initialization are no-op Spans.
 | |
| 
 | |
| Once an SDK has been initialized, all provided no-op Tracers are swapped for
 | |
| Tracers provided by the SDK defined TracerProvider. However, any Span started
 | |
| prior to this initialization does not change its behavior. Meaning, the Span
 | |
| remains a no-op Span.
 | |
| 
 | |
| The implementation to track and swap Tracers locks all new Tracer creation
 | |
| until the swap is complete. This assumes that this operation is not
 | |
| performance-critical. If that assumption is incorrect, be sure to configure an
 | |
| SDK prior to any Tracer creation.
 | |
| */
 | |
| 
 | |
| import (
 | |
| 	"context"
 | |
| 	"sync"
 | |
| 	"sync/atomic"
 | |
| 
 | |
| 	"go.opentelemetry.io/auto/sdk"
 | |
| 
 | |
| 	"go.opentelemetry.io/otel/attribute"
 | |
| 	"go.opentelemetry.io/otel/codes"
 | |
| 	"go.opentelemetry.io/otel/trace"
 | |
| 	"go.opentelemetry.io/otel/trace/embedded"
 | |
| )
 | |
| 
 | |
| // tracerProvider is a placeholder for a configured SDK TracerProvider.
 | |
| //
 | |
| // All TracerProvider functionality is forwarded to a delegate once
 | |
| // configured.
 | |
| type tracerProvider struct {
 | |
| 	embedded.TracerProvider
 | |
| 
 | |
| 	mtx      sync.Mutex
 | |
| 	tracers  map[il]*tracer
 | |
| 	delegate trace.TracerProvider
 | |
| }
 | |
| 
 | |
| // Compile-time guarantee that tracerProvider implements the TracerProvider
 | |
| // interface.
 | |
| var _ trace.TracerProvider = &tracerProvider{}
 | |
| 
 | |
| // setDelegate configures p to delegate all TracerProvider functionality to
 | |
| // provider.
 | |
| //
 | |
| // All Tracers provided prior to this function call are switched out to be
 | |
| // Tracers provided by provider.
 | |
| //
 | |
| // It is guaranteed by the caller that this happens only once.
 | |
| func (p *tracerProvider) setDelegate(provider trace.TracerProvider) {
 | |
| 	p.mtx.Lock()
 | |
| 	defer p.mtx.Unlock()
 | |
| 
 | |
| 	p.delegate = provider
 | |
| 
 | |
| 	if len(p.tracers) == 0 {
 | |
| 		return
 | |
| 	}
 | |
| 
 | |
| 	for _, t := range p.tracers {
 | |
| 		t.setDelegate(provider)
 | |
| 	}
 | |
| 
 | |
| 	p.tracers = nil
 | |
| }
 | |
| 
 | |
| // Tracer implements TracerProvider.
 | |
| func (p *tracerProvider) Tracer(name string, opts ...trace.TracerOption) trace.Tracer {
 | |
| 	p.mtx.Lock()
 | |
| 	defer p.mtx.Unlock()
 | |
| 
 | |
| 	if p.delegate != nil {
 | |
| 		return p.delegate.Tracer(name, opts...)
 | |
| 	}
 | |
| 
 | |
| 	// At this moment it is guaranteed that no sdk is installed, save the tracer in the tracers map.
 | |
| 
 | |
| 	c := trace.NewTracerConfig(opts...)
 | |
| 	key := il{
 | |
| 		name:    name,
 | |
| 		version: c.InstrumentationVersion(),
 | |
| 		schema:  c.SchemaURL(),
 | |
| 		attrs:   c.InstrumentationAttributes(),
 | |
| 	}
 | |
| 
 | |
| 	if p.tracers == nil {
 | |
| 		p.tracers = make(map[il]*tracer)
 | |
| 	}
 | |
| 
 | |
| 	if val, ok := p.tracers[key]; ok {
 | |
| 		return val
 | |
| 	}
 | |
| 
 | |
| 	t := &tracer{name: name, opts: opts, provider: p}
 | |
| 	p.tracers[key] = t
 | |
| 	return t
 | |
| }
 | |
| 
 | |
| type il struct {
 | |
| 	name    string
 | |
| 	version string
 | |
| 	schema  string
 | |
| 	attrs   attribute.Set
 | |
| }
 | |
| 
 | |
| // tracer is a placeholder for a trace.Tracer.
 | |
| //
 | |
| // All Tracer functionality is forwarded to a delegate once configured.
 | |
| // Otherwise, all functionality is forwarded to a NoopTracer.
 | |
| type tracer struct {
 | |
| 	embedded.Tracer
 | |
| 
 | |
| 	name     string
 | |
| 	opts     []trace.TracerOption
 | |
| 	provider *tracerProvider
 | |
| 
 | |
| 	delegate atomic.Value
 | |
| }
 | |
| 
 | |
| // Compile-time guarantee that tracer implements the trace.Tracer interface.
 | |
| var _ trace.Tracer = &tracer{}
 | |
| 
 | |
| // setDelegate configures t to delegate all Tracer functionality to Tracers
 | |
| // created by provider.
 | |
| //
 | |
| // All subsequent calls to the Tracer methods will be passed to the delegate.
 | |
| //
 | |
| // It is guaranteed by the caller that this happens only once.
 | |
| func (t *tracer) setDelegate(provider trace.TracerProvider) {
 | |
| 	t.delegate.Store(provider.Tracer(t.name, t.opts...))
 | |
| }
 | |
| 
 | |
| // Start implements trace.Tracer by forwarding the call to t.delegate if
 | |
| // set, otherwise it forwards the call to a NoopTracer.
 | |
| func (t *tracer) Start(ctx context.Context, name string, opts ...trace.SpanStartOption) (context.Context, trace.Span) {
 | |
| 	delegate := t.delegate.Load()
 | |
| 	if delegate != nil {
 | |
| 		return delegate.(trace.Tracer).Start(ctx, name, opts...)
 | |
| 	}
 | |
| 
 | |
| 	return t.newSpan(ctx, autoInstEnabled, name, opts)
 | |
| }
 | |
| 
 | |
| // autoInstEnabled determines if the auto-instrumentation SDK span is returned
 | |
| // from the tracer when not backed by a delegate and auto-instrumentation has
 | |
| // attached to this process.
 | |
| //
 | |
| // The auto-instrumentation is expected to overwrite this value to true when it
 | |
| // attaches. By default, this will point to false and mean a tracer will return
 | |
| // a nonRecordingSpan by default.
 | |
| var autoInstEnabled = new(bool)
 | |
| 
 | |
| // newSpan is called by tracer.Start so auto-instrumentation can attach an eBPF
 | |
| // uprobe to this code.
 | |
| //
 | |
| // "noinline" pragma prevents the method from ever being inlined.
 | |
| //
 | |
| //go:noinline
 | |
| func (t *tracer) newSpan(
 | |
| 	ctx context.Context,
 | |
| 	autoSpan *bool,
 | |
| 	name string,
 | |
| 	opts []trace.SpanStartOption,
 | |
| ) (context.Context, trace.Span) {
 | |
| 	// autoInstEnabled is passed to newSpan via the autoSpan parameter. This is
 | |
| 	// so the auto-instrumentation can define a uprobe for (*t).newSpan and be
 | |
| 	// provided with the address of the bool autoInstEnabled points to. It
 | |
| 	// needs to be a parameter so that pointer can be reliably determined, it
 | |
| 	// should not be read from the global.
 | |
| 
 | |
| 	if *autoSpan {
 | |
| 		tracer := sdk.TracerProvider().Tracer(t.name, t.opts...)
 | |
| 		return tracer.Start(ctx, name, opts...)
 | |
| 	}
 | |
| 
 | |
| 	s := nonRecordingSpan{sc: trace.SpanContextFromContext(ctx), tracer: t}
 | |
| 	ctx = trace.ContextWithSpan(ctx, s)
 | |
| 	return ctx, s
 | |
| }
 | |
| 
 | |
| // nonRecordingSpan is a minimal implementation of a Span that wraps a
 | |
| // SpanContext. It performs no operations other than to return the wrapped
 | |
| // SpanContext.
 | |
| type nonRecordingSpan struct {
 | |
| 	embedded.Span
 | |
| 
 | |
| 	sc     trace.SpanContext
 | |
| 	tracer *tracer
 | |
| }
 | |
| 
 | |
| var _ trace.Span = nonRecordingSpan{}
 | |
| 
 | |
| // SpanContext returns the wrapped SpanContext.
 | |
| func (s nonRecordingSpan) SpanContext() trace.SpanContext { return s.sc }
 | |
| 
 | |
| // IsRecording always returns false.
 | |
| func (nonRecordingSpan) IsRecording() bool { return false }
 | |
| 
 | |
| // SetStatus does nothing.
 | |
| func (nonRecordingSpan) SetStatus(codes.Code, string) {}
 | |
| 
 | |
| // SetError does nothing.
 | |
| func (nonRecordingSpan) SetError(bool) {}
 | |
| 
 | |
| // SetAttributes does nothing.
 | |
| func (nonRecordingSpan) SetAttributes(...attribute.KeyValue) {}
 | |
| 
 | |
| // End does nothing.
 | |
| func (nonRecordingSpan) End(...trace.SpanEndOption) {}
 | |
| 
 | |
| // RecordError does nothing.
 | |
| func (nonRecordingSpan) RecordError(error, ...trace.EventOption) {}
 | |
| 
 | |
| // AddEvent does nothing.
 | |
| func (nonRecordingSpan) AddEvent(string, ...trace.EventOption) {}
 | |
| 
 | |
| // AddLink does nothing.
 | |
| func (nonRecordingSpan) AddLink(trace.Link) {}
 | |
| 
 | |
| // SetName does nothing.
 | |
| func (nonRecordingSpan) SetName(string) {}
 | |
| 
 | |
| func (s nonRecordingSpan) TracerProvider() trace.TracerProvider { return s.tracer.provider }
 |