Repository navigation
feat: Docker provider with full Provider interface - #4
Merged
Merged
Conversation
- Implement all 16 Provider interface methods using Go Docker SDK v27 (no CLI exec — pure API via github.com/docker/docker/client) - Spawn: ContainerCreate + ContainerStart with full security hardening (cap_drop, network isolation, read-only rootfs, seccomp, cgroup limits) - Exec/ExecStream: ContainerExecCreate + ContainerExecAttach with stdcopy.StdCopy for proper stdout/stderr demultiplexing - WriteFile: in-memory tar archive via CopyToContainer - ReadFile: CopyFromContainer + tar extraction via tarFileReader - ListFiles: shell loop with stat -c and | separator (BusyBox-safe) - GlobFiles: pattern passed via $GLOB_PATTERN env var (injection-safe) - StatFile: ContainerStatPath + exec stat for full metadata - Runtime field supports runc (default), runsc (gVisor), kata-runtime - Pool mode: scoped workspace paths with traversal prevention - 20 tests: unit (no Docker needed) + integration (skipIfNoDocker) - Register Docker provider in cmd_serve.go - Add DockerConfig + PoolSecurityConfig to internal/config - Update README: SVG architecture diagram, Docker provider docs, comparison table, remove E2B from provider diagram (partial impl)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Providerinterface methodscap_drop: ALL, network isolation, read-only rootfs, seccomp, cgroup limits (memory + CPU quota + pids)runc(default) →runsc(gVisor) →kata-runtime(Kata) — one config line/workspace/{sandbox-id}/paths with path traversal preventionGlobFilespasses pattern via$GLOB_PATTERNenv var, never string-interpolatedKey implementation details
Exec/ExecStream: usesstdcopy.StdCopyto demux Docker's multiplexed stdout/stderr streamWriteFile: in-memory tar archive →CopyToContainerReadFile:CopyFromContainer→ tar extraction viatarFileReaderListFiles: shellwhile readloop withstat -c '%n|%s|%a|%F|%Y'(BusyBox-safe,|separator)ExecStream:ctxChanWriterwithselect { ctx.Done() }prevents goroutine leaks on cancelled contextDestroy: removes from sandboxes map before Docker API call — guarantees cleanup even on errorensureImage: checks local image cache before pulling; detects partial pulls viaio.CopyerrorTest plan
go test ./internal/providers/ -run TestDockerProvider -v— unit tests pass without Dockergo test ./internal/providers/ -run TestDockerIntegration -v— integration tests with Docker runninggo build ./...— clean buildforgevm.yaml(docker provider enabled) and runscripts/test_multiuser_pool.pyruntime: runscin config, confirm containers start with gVisor runtime