tegwick
cf490220f4
Reachability gains pid/workspace_dir, populated by enrich_reachability whenever a backend's wait_ready() returns a pid: endpoint (currently just ext.bwrap). build_reachability_report() now also returns a local_exec_hint (nsenter into the pid's namespaces) alongside the existing ssh_one_liner, so glas-harness can branch on which is populated instead of assuming every sandbox is SSH-reachable. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
3.9 KiB
| id | title | status | state_hub_workstream_id |
|---|---|---|---|
| SAND-WP-0013 | Bubblewrap (bwrap) local-exec extension | proposed | 29d6bdc4-69a4-4d06-b7c1-eb335aa6ab5e |
Add the first local, same-host, kernel-namespace-only sandbox extension.
Every current self-hosted extension (ext.compose-ssh, ext.vm-packer)
requires an SSH hop to a remote host plus a container runtime or VM.
bwrap (already installed on the workstation, unused) fills the gap: a
fast, no-remote-host, no-container-runtime backend, and the first
extension able to actually enforce the network.default: deny every
profile already declares but only documents today (docs/security.md
admits enforcement "varies by extension").
Task: Extend the isolation-level model
IsolationSpec.level in src/sandboxer/models.py is a closed
Literal["container", "microvm", "policy"]. Add a value for
namespace/process-level isolation (e.g. "process") and update any
validation/display logic that switches on it.
id: SAND-WP-0013-T01
status: done
priority: high
state_hub_task_id: "b55e6025-2d80-4dc3-aed8-50b15adbdf04"
Task: Implement BwrapExtension
New src/sandboxer/extensions/bwrap.py implementing the
SandboxExtension ABC (provision/wait_ready/teardown):
provision() creates a per-sandbox workspace dir, spawns the target
under bwrap with new user/mount/pid/net namespaces, a tmpfs root, bind
mounts scoped to the workspace, and --unshare-net (or a loopback-only
net namespace) so declared network-deny is real; handle =
{sandbox_id, host: "localhost", pid, workspace_dir}. wait_ready()
checks the process is alive and the workspace exists. teardown() kills
the process group and removes the workspace. No snapshot support
initially (supports_snapshots() stays False).
id: SAND-WP-0013-T02
status: done
priority: high
state_hub_task_id: "703d09c6-2f98-44da-9b61-c0d0612b0603"
Task: Register the extension and a profile
extensions/ext.bwrap.yaml (handler path, capabilities.isolation_levels
including the new value, pricing_model: self-hosted). New
profiles/profile.bwrap-local.yaml bound to ext.bwrap, network. default: deny actually meaningful this time, suitable for CI/local dev.
id: SAND-WP-0013-T03
status: done
priority: medium
state_hub_task_id: "fd0ae8c8-c9ae-4cd6-a840-4b5b65574f73"
Task: Resolve local reachability vs. the SSH-based consumer contract
docs/integrations/glas-harness.md documents glas-harness consuming
sandboxes via reachability.ssh + remote_dir. A same-host bwrap
sandbox has no SSH hop. Decide and document: a new local reachability
descriptor (e.g. reachability.local with a direct workspace path +
PID), vs. requiring glas-harness to gain a direct-subprocess-exec
consumption mode. Update docs/integrations/glas-harness.md and
reachability/enrich.py accordingly. Coordinate with glas-harness
GLAS-WP-0001 (harness contract) so both sides agree before either is
built against the other.
id: SAND-WP-0013-T04
status: done
priority: high
state_hub_task_id: "1d8b3e18-d067-4364-89e9-5d5bc5923deb"
Task: Extend manager's handle whitelist
core/manager.py::_handle_from_status reconstructs a fixed set of
fields from stored inputs for teardown/snapshot calls. Add bwrap's
handle fields (pid, workspace_dir) to that whitelist so
teardown/restart survives a sandboxer CLI/process restart.
id: SAND-WP-0013-T05
status: done
priority: medium
state_hub_task_id: "9a410ce3-9e9c-42d2-abe7-95ad740279a2"
Task: Tests
Mirror the existing extension test pattern (mock the subprocess/bwrap
invocation the way tests/ mocks SSHConfig.run for compose-ssh);
cover provision/wait_ready/teardown, the new isolation-level value, and
extension_base conformance (SandboxExtension subclass checks already
exercised generically in test_extension_base.py).
id: SAND-WP-0013-T06
status: done
priority: medium
state_hub_task_id: "d9271eae-9177-4a55-bfb4-082408feb2a1"