History

tegwick 76c38e758c All checks were successful CI Smoke / host-smoke (push) Successful in 0s Details CI Smoke / container-smoke (push) Successful in 2s Details Implement ext.bwrap: local bubblewrap namespace extension (SAND-WP-0013) Adds the first local, same-host, kernel-namespace-only sandbox extension: no SSH hop, no container runtime. Extends IsolationSpec.level with "process", implements BwrapExtension (provision/wait_ready/ teardown) spawning bwrap with unshared user/mount/pid/ipc/uts/net namespaces, registers ext.bwrap + profile.bwrap-local, and extends manager._handle_from_status to carry pid/workspace_dir. Verified with a live bwrap smoke run in addition to the mocked test suite. T04 (reachability vs. the SSH-based glas-harness consumer contract) deliberately left open pending glas-harness's harness contract. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>		2026-07-26 12:37:56 +02:00
..
ext.bwrap.yaml	Implement ext.bwrap: local bubblewrap namespace extension (SAND-WP-0013)	2026-07-26 12:37:56 +02:00
ext.compose-ssh.yaml	feat: snapshot/restore checkpoints (SAND-WP-0007)	2026-06-24 07:57:40 +02:00
ext.e2b.yaml	feat: cloud adapters E2B/Modal and billing export (SAND-WP-0010)	2026-06-24 12:50:19 +02:00
ext.modal.yaml	feat: cloud adapters E2B/Modal and billing export (SAND-WP-0010)	2026-06-24 12:50:19 +02:00
ext.saas-stub.yaml	Implement SAND-WP-0006: SaaS payments, routing, and ext.saas-stub	2026-06-24 07:52:20 +02:00
ext.vm-packer.yaml	feat: Packer build orchestration (SAND-WP-0012)	2026-06-24 12:56:32 +02:00
README.md	Implement SAND-WP-0006: SaaS payments, routing, and ext.saas-stub	2026-06-24 07:52:20 +02:00

README.md

Extensions

Backend adapters for sandbox establishment. Each extension is declared in ext.<name>.yaml and implements provision, wait_ready, and teardown.

Author guide: docs/extension-sdk.md

ext.compose-ssh

Self-hosted extension migrated from the-custodian/e2e-framework/.

Provision: SSH to configured host → isolated directory per sandbox id → rsync repo → docker compose up with unique project name.

wait_ready: Confirms compose services are running (docker compose ps). Does not run HTTP health checks — wise-validator owns that.

teardown: compose down + remove remote directory (idempotent).

Compose runtime: defaults to docker compose. On CoulombCore set SANDBOXER_COMPOSE_CMD=podman-compose.

Compatibility note for `make e2e` callers

Legacy make e2e REPO=<repo> runs provision + health + tests + teardown in one step. sand-boxer splits responsibilities:

Step	Owner
rsync + compose up/down	sand-boxer (`ext.compose-ssh`)
health checks + test_command	wise-validator (SAND-WP-0003)

Interim workflow: sandboxer create --profile profile.compose-e2e --input repo=... then run validation separately until wise-validator migration lands.

ext.vm-packer

Attach mode for pre-built VMs (the-custodian/infra/build-machines/ lineage).

Provision: SSH to VM alias or tunnel port → isolated workspace under /build/sbx-<id>/ → optional rsync of repo input.

wait_ready: Confirms workspace directory exists on VM.

teardown: Removes workspace only; VM persists.

Profile: profile.vm-haskell-build — see docs/runbooks/profile-vm-haskell-build.md.

Packer build / OVA import remains operator-driven (not triggered by create).

ext.saas-stub

Metered SaaS stub for payments and routing v0 (SAND-WP-0006). No external API.

estimate_cost / meter_actual: credits check on create; debit on destroy.

Profile: profile.saas-stub (explicit), profile.burst-sandbox (self-hosted fallback).

See docs/payments.md and docs/routing.md.