 8d9b62daf3
			
		
	
	8d9b62daf3
	
	
	
		
			
			This commit implements Phase 2 of the CHORUS Task Execution Engine development plan, providing a comprehensive execution environment abstraction layer with Docker container sandboxing support. ## New Features ### Core Sandbox Interface - Comprehensive ExecutionSandbox interface with isolated task execution - Support for command execution, file I/O, environment management - Resource usage monitoring and sandbox lifecycle management - Standardized error handling with SandboxError types and categories ### Docker Container Sandbox Implementation - Full Docker API integration with secure container creation - Transparent repository mounting with configurable read/write access - Advanced security policies with capability dropping and privilege controls - Comprehensive resource limits (CPU, memory, disk, processes, file handles) - Support for tmpfs mounts, masked paths, and read-only bind mounts - Container lifecycle management with proper cleanup and health monitoring ### Security & Resource Management - Configurable security policies with SELinux, AppArmor, and Seccomp support - Fine-grained capability management with secure defaults - Network isolation options with configurable DNS and proxy settings - Resource monitoring with real-time CPU, memory, and network usage tracking - Comprehensive ulimits configuration for process and file handle limits ### Repository Integration - Seamless repository mounting from local paths to container workspaces - Git configuration support with user credentials and global settings - File inclusion/exclusion patterns for selective repository access - Configurable permissions and ownership for mounted repositories ### Testing Infrastructure - Comprehensive test suite with 60+ test cases covering all functionality - Docker integration tests with Alpine Linux containers (skipped in short mode) - Mock sandbox implementation for unit testing without Docker dependencies - Security policy validation tests with read-only filesystem enforcement - Resource usage monitoring and cleanup verification tests ## Technical Details ### Dependencies Added - github.com/docker/docker v28.4.0+incompatible - Docker API client - github.com/docker/go-connections v0.6.0 - Docker connection utilities - github.com/docker/go-units v0.5.0 - Docker units and formatting - Associated Docker API dependencies for complete container management ### Architecture - Interface-driven design enabling multiple sandbox implementations - Comprehensive configuration structures for all sandbox aspects - Resource usage tracking with detailed metrics collection - Error handling with retryable error classification - Proper cleanup and resource management throughout sandbox lifecycle ### Compatibility - Maintains backward compatibility with existing CHORUS architecture - Designed for future integration with Phase 3 Core Task Execution Engine - Extensible design supporting additional sandbox implementations (VM, process) This Phase 2 implementation provides the foundation for secure, isolated task execution that will be integrated with the AI model providers from Phase 1 in the upcoming Phase 3 development. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
		
			
				
	
	
		
			238 lines
		
	
	
		
			6.5 KiB
		
	
	
	
		
			Go
		
	
	
	
	
	
			
		
		
	
	
			238 lines
		
	
	
		
			6.5 KiB
		
	
	
	
		
			Go
		
	
	
	
	
	
| // Package nat is a convenience package for manipulation of strings describing network ports.
 | |
| package nat
 | |
| 
 | |
| import (
 | |
| 	"errors"
 | |
| 	"fmt"
 | |
| 	"net"
 | |
| 	"strconv"
 | |
| 	"strings"
 | |
| )
 | |
| 
 | |
| // PortBinding represents a binding between a Host IP address and a Host Port
 | |
| type PortBinding struct {
 | |
| 	// HostIP is the host IP Address
 | |
| 	HostIP string `json:"HostIp"`
 | |
| 	// HostPort is the host port number
 | |
| 	HostPort string
 | |
| }
 | |
| 
 | |
| // PortMap is a collection of PortBinding indexed by Port
 | |
| type PortMap map[Port][]PortBinding
 | |
| 
 | |
| // PortSet is a collection of structs indexed by Port
 | |
| type PortSet map[Port]struct{}
 | |
| 
 | |
| // Port is a string containing port number and protocol in the format "80/tcp"
 | |
| type Port string
 | |
| 
 | |
| // NewPort creates a new instance of a Port given a protocol and port number or port range
 | |
| func NewPort(proto, port string) (Port, error) {
 | |
| 	// Check for parsing issues on "port" now so we can avoid having
 | |
| 	// to check it later on.
 | |
| 
 | |
| 	portStartInt, portEndInt, err := ParsePortRangeToInt(port)
 | |
| 	if err != nil {
 | |
| 		return "", err
 | |
| 	}
 | |
| 
 | |
| 	if portStartInt == portEndInt {
 | |
| 		return Port(fmt.Sprintf("%d/%s", portStartInt, proto)), nil
 | |
| 	}
 | |
| 	return Port(fmt.Sprintf("%d-%d/%s", portStartInt, portEndInt, proto)), nil
 | |
| }
 | |
| 
 | |
| // ParsePort parses the port number string and returns an int
 | |
| func ParsePort(rawPort string) (int, error) {
 | |
| 	if rawPort == "" {
 | |
| 		return 0, nil
 | |
| 	}
 | |
| 	port, err := strconv.ParseUint(rawPort, 10, 16)
 | |
| 	if err != nil {
 | |
| 		return 0, fmt.Errorf("invalid port '%s': %w", rawPort, errors.Unwrap(err))
 | |
| 	}
 | |
| 	return int(port), nil
 | |
| }
 | |
| 
 | |
| // ParsePortRangeToInt parses the port range string and returns start/end ints
 | |
| func ParsePortRangeToInt(rawPort string) (int, int, error) {
 | |
| 	if rawPort == "" {
 | |
| 		return 0, 0, nil
 | |
| 	}
 | |
| 	start, end, err := ParsePortRange(rawPort)
 | |
| 	if err != nil {
 | |
| 		return 0, 0, err
 | |
| 	}
 | |
| 	return int(start), int(end), nil
 | |
| }
 | |
| 
 | |
| // Proto returns the protocol of a Port
 | |
| func (p Port) Proto() string {
 | |
| 	proto, _ := SplitProtoPort(string(p))
 | |
| 	return proto
 | |
| }
 | |
| 
 | |
| // Port returns the port number of a Port
 | |
| func (p Port) Port() string {
 | |
| 	_, port := SplitProtoPort(string(p))
 | |
| 	return port
 | |
| }
 | |
| 
 | |
| // Int returns the port number of a Port as an int
 | |
| func (p Port) Int() int {
 | |
| 	portStr := p.Port()
 | |
| 	// We don't need to check for an error because we're going to
 | |
| 	// assume that any error would have been found, and reported, in NewPort()
 | |
| 	port, _ := ParsePort(portStr)
 | |
| 	return port
 | |
| }
 | |
| 
 | |
| // Range returns the start/end port numbers of a Port range as ints
 | |
| func (p Port) Range() (int, int, error) {
 | |
| 	return ParsePortRangeToInt(p.Port())
 | |
| }
 | |
| 
 | |
| // SplitProtoPort splits a port(range) and protocol, formatted as "<portnum>/[<proto>]"
 | |
| // "<startport-endport>/[<proto>]". It returns an empty string for both if
 | |
| // no port(range) is provided. If a port(range) is provided, but no protocol,
 | |
| // the default ("tcp") protocol is returned.
 | |
| //
 | |
| // SplitProtoPort does not validate or normalize the returned values.
 | |
| func SplitProtoPort(rawPort string) (proto string, port string) {
 | |
| 	port, proto, _ = strings.Cut(rawPort, "/")
 | |
| 	if port == "" {
 | |
| 		return "", ""
 | |
| 	}
 | |
| 	if proto == "" {
 | |
| 		proto = "tcp"
 | |
| 	}
 | |
| 	return proto, port
 | |
| }
 | |
| 
 | |
| func validateProto(proto string) error {
 | |
| 	switch proto {
 | |
| 	case "tcp", "udp", "sctp":
 | |
| 		// All good
 | |
| 		return nil
 | |
| 	default:
 | |
| 		return errors.New("invalid proto: " + proto)
 | |
| 	}
 | |
| }
 | |
| 
 | |
| // ParsePortSpecs receives port specs in the format of ip:public:private/proto and parses
 | |
| // these in to the internal types
 | |
| func ParsePortSpecs(ports []string) (map[Port]struct{}, map[Port][]PortBinding, error) {
 | |
| 	var (
 | |
| 		exposedPorts = make(map[Port]struct{}, len(ports))
 | |
| 		bindings     = make(map[Port][]PortBinding)
 | |
| 	)
 | |
| 	for _, p := range ports {
 | |
| 		portMappings, err := ParsePortSpec(p)
 | |
| 		if err != nil {
 | |
| 			return nil, nil, err
 | |
| 		}
 | |
| 
 | |
| 		for _, pm := range portMappings {
 | |
| 			port := pm.Port
 | |
| 			if _, ok := exposedPorts[port]; !ok {
 | |
| 				exposedPorts[port] = struct{}{}
 | |
| 			}
 | |
| 			bindings[port] = append(bindings[port], pm.Binding)
 | |
| 		}
 | |
| 	}
 | |
| 	return exposedPorts, bindings, nil
 | |
| }
 | |
| 
 | |
| // PortMapping is a data object mapping a Port to a PortBinding
 | |
| type PortMapping struct {
 | |
| 	Port    Port
 | |
| 	Binding PortBinding
 | |
| }
 | |
| 
 | |
| func (p *PortMapping) String() string {
 | |
| 	return net.JoinHostPort(p.Binding.HostIP, p.Binding.HostPort+":"+string(p.Port))
 | |
| }
 | |
| 
 | |
| func splitParts(rawport string) (hostIP, hostPort, containerPort string) {
 | |
| 	parts := strings.Split(rawport, ":")
 | |
| 
 | |
| 	switch len(parts) {
 | |
| 	case 1:
 | |
| 		return "", "", parts[0]
 | |
| 	case 2:
 | |
| 		return "", parts[0], parts[1]
 | |
| 	case 3:
 | |
| 		return parts[0], parts[1], parts[2]
 | |
| 	default:
 | |
| 		n := len(parts)
 | |
| 		return strings.Join(parts[:n-2], ":"), parts[n-2], parts[n-1]
 | |
| 	}
 | |
| }
 | |
| 
 | |
| // ParsePortSpec parses a port specification string into a slice of PortMappings
 | |
| func ParsePortSpec(rawPort string) ([]PortMapping, error) {
 | |
| 	ip, hostPort, containerPort := splitParts(rawPort)
 | |
| 	proto, containerPort := SplitProtoPort(containerPort)
 | |
| 	proto = strings.ToLower(proto)
 | |
| 	if err := validateProto(proto); err != nil {
 | |
| 		return nil, err
 | |
| 	}
 | |
| 
 | |
| 	if ip != "" && ip[0] == '[' {
 | |
| 		// Strip [] from IPV6 addresses
 | |
| 		rawIP, _, err := net.SplitHostPort(ip + ":")
 | |
| 		if err != nil {
 | |
| 			return nil, fmt.Errorf("invalid IP address %v: %w", ip, err)
 | |
| 		}
 | |
| 		ip = rawIP
 | |
| 	}
 | |
| 	if ip != "" && net.ParseIP(ip) == nil {
 | |
| 		return nil, errors.New("invalid IP address: " + ip)
 | |
| 	}
 | |
| 	if containerPort == "" {
 | |
| 		return nil, fmt.Errorf("no port specified: %s<empty>", rawPort)
 | |
| 	}
 | |
| 
 | |
| 	startPort, endPort, err := ParsePortRange(containerPort)
 | |
| 	if err != nil {
 | |
| 		return nil, errors.New("invalid containerPort: " + containerPort)
 | |
| 	}
 | |
| 
 | |
| 	var startHostPort, endHostPort uint64
 | |
| 	if hostPort != "" {
 | |
| 		startHostPort, endHostPort, err = ParsePortRange(hostPort)
 | |
| 		if err != nil {
 | |
| 			return nil, errors.New("invalid hostPort: " + hostPort)
 | |
| 		}
 | |
| 		if (endPort - startPort) != (endHostPort - startHostPort) {
 | |
| 			// Allow host port range iff containerPort is not a range.
 | |
| 			// In this case, use the host port range as the dynamic
 | |
| 			// host port range to allocate into.
 | |
| 			if endPort != startPort {
 | |
| 				return nil, fmt.Errorf("invalid ranges specified for container and host Ports: %s and %s", containerPort, hostPort)
 | |
| 			}
 | |
| 		}
 | |
| 	}
 | |
| 
 | |
| 	count := endPort - startPort + 1
 | |
| 	ports := make([]PortMapping, 0, count)
 | |
| 
 | |
| 	for i := uint64(0); i < count; i++ {
 | |
| 		cPort := Port(strconv.FormatUint(startPort+i, 10) + "/" + proto)
 | |
| 		hPort := ""
 | |
| 		if hostPort != "" {
 | |
| 			hPort = strconv.FormatUint(startHostPort+i, 10)
 | |
| 			// Set hostPort to a range only if there is a single container port
 | |
| 			// and a dynamic host port.
 | |
| 			if count == 1 && startHostPort != endHostPort {
 | |
| 				hPort += "-" + strconv.FormatUint(endHostPort, 10)
 | |
| 			}
 | |
| 		}
 | |
| 		ports = append(ports, PortMapping{
 | |
| 			Port:    cPort,
 | |
| 			Binding: PortBinding{HostIP: ip, HostPort: hPort},
 | |
| 		})
 | |
| 	}
 | |
| 	return ports, nil
 | |
| }
 |