8d9b62daf3
This commit implements Phase 2 of the CHORUS Task Execution Engine development plan, providing a comprehensive execution environment abstraction layer with Docker container sandboxing support. ## New Features ### Core Sandbox Interface - Comprehensive ExecutionSandbox interface with isolated task execution - Support for command execution, file I/O, environment management - Resource usage monitoring and sandbox lifecycle management - Standardized error handling with SandboxError types and categories ### Docker Container Sandbox Implementation - Full Docker API integration with secure container creation - Transparent repository mounting with configurable read/write access - Advanced security policies with capability dropping and privilege controls - Comprehensive resource limits (CPU, memory, disk, processes, file handles) - Support for tmpfs mounts, masked paths, and read-only bind mounts - Container lifecycle management with proper cleanup and health monitoring ### Security & Resource Management - Configurable security policies with SELinux, AppArmor, and Seccomp support - Fine-grained capability management with secure defaults - Network isolation options with configurable DNS and proxy settings - Resource monitoring with real-time CPU, memory, and network usage tracking - Comprehensive ulimits configuration for process and file handle limits ### Repository Integration - Seamless repository mounting from local paths to container workspaces - Git configuration support with user credentials and global settings - File inclusion/exclusion patterns for selective repository access - Configurable permissions and ownership for mounted repositories ### Testing Infrastructure - Comprehensive test suite with 60+ test cases covering all functionality - Docker integration tests with Alpine Linux containers (skipped in short mode) - Mock sandbox implementation for unit testing without Docker dependencies - Security policy validation tests with read-only filesystem enforcement - Resource usage monitoring and cleanup verification tests ## Technical Details ### Dependencies Added - github.com/docker/docker v28.4.0+incompatible - Docker API client - github.com/docker/go-connections v0.6.0 - Docker connection utilities - github.com/docker/go-units v0.5.0 - Docker units and formatting - Associated Docker API dependencies for complete container management ### Architecture - Interface-driven design enabling multiple sandbox implementations - Comprehensive configuration structures for all sandbox aspects - Resource usage tracking with detailed metrics collection - Error handling with retryable error classification - Proper cleanup and resource management throughout sandbox lifecycle ### Compatibility - Maintains backward compatibility with existing CHORUS architecture - Designed for future integration with Phase 3 Core Task Execution Engine - Extensible design supporting additional sandbox implementations (VM, process) This Phase 2 implementation provides the foundation for secure, isolated task execution that will be integrated with the AI model providers from Phase 1 in the upcoming Phase 3 development. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
55 lines
2.1 KiB
Go
55 lines
2.1 KiB
Go
package v1
|
|
|
|
import (
|
|
"time"
|
|
|
|
ocispec "github.com/opencontainers/image-spec/specs-go/v1"
|
|
)
|
|
|
|
const DockerOCIImageMediaType = "application/vnd.docker.container.image.v1+json"
|
|
|
|
// DockerOCIImage is a ocispec.Image extended with Docker specific Config.
|
|
type DockerOCIImage struct {
|
|
ocispec.Image
|
|
|
|
// Shadow ocispec.Image.Config
|
|
Config DockerOCIImageConfig `json:"config,omitempty"`
|
|
}
|
|
|
|
// DockerOCIImageConfig is a ocispec.ImageConfig extended with Docker specific fields.
|
|
type DockerOCIImageConfig struct {
|
|
ocispec.ImageConfig
|
|
|
|
DockerOCIImageConfigExt
|
|
}
|
|
|
|
// DockerOCIImageConfigExt contains Docker-specific fields in DockerImageConfig.
|
|
type DockerOCIImageConfigExt struct {
|
|
Healthcheck *HealthcheckConfig `json:",omitempty"` // Healthcheck describes how to check the container is healthy
|
|
|
|
OnBuild []string `json:",omitempty"` // ONBUILD metadata that were defined on the image Dockerfile
|
|
Shell []string `json:",omitempty"` // Shell for shell-form of RUN, CMD, ENTRYPOINT
|
|
}
|
|
|
|
// HealthcheckConfig holds configuration settings for the HEALTHCHECK feature.
|
|
type HealthcheckConfig struct {
|
|
// Test is the test to perform to check that the container is healthy.
|
|
// An empty slice means to inherit the default.
|
|
// The options are:
|
|
// {} : inherit healthcheck
|
|
// {"NONE"} : disable healthcheck
|
|
// {"CMD", args...} : exec arguments directly
|
|
// {"CMD-SHELL", command} : run command with system's default shell
|
|
Test []string `json:",omitempty"`
|
|
|
|
// Zero means to inherit. Durations are expressed as integer nanoseconds.
|
|
Interval time.Duration `json:",omitempty"` // Interval is the time to wait between checks.
|
|
Timeout time.Duration `json:",omitempty"` // Timeout is the time to wait before considering the check to have hung.
|
|
StartPeriod time.Duration `json:",omitempty"` // The start period for the container to initialize before the retries starts to count down.
|
|
StartInterval time.Duration `json:",omitempty"` // The interval to attempt healthchecks at during the start period
|
|
|
|
// Retries is the number of consecutive failures needed to consider a container as unhealthy.
|
|
// Zero means inherit.
|
|
Retries int `json:",omitempty"`
|
|
}
|