Chore/upgrade x net to v0.54.0

docker/generate.sh

@@ -104,7 +104,7 @@ generate_all() {
     for env in production test; do
         for arch in amd64 arm64; do
             echo "Generating $env-$arch..."
-            "$0" "$env" "$arch"
+            bash "$0" "$env" "$arch"
         done
     done
 

docker/versions.yaml

@@ -2,7 +2,7 @@
 versions:
   # Base images
   python: "dhi.io/python:3-debian13-sfw-ent-dev"
-  golang: "1.24.13"
+  golang: "1.26.3"
   nodejs: "v20.20.0"
 
   # Python packages (unified configuration)

go.mod

@@ -1,11 +1,12 @@
 module github.com/langgenius/dify-sandbox
 
-go 1.24.11
+go 1.26
 
 require (
 	github.com/gin-gonic/gin v1.10.0
 	github.com/google/uuid v1.6.0
 	github.com/seccomp/libseccomp-golang v0.11.0
+	gopkg.in/natefinch/lumberjack.v2 v2.2.1
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -29,10 +30,9 @@ require (
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.2.12 // indirect
 	golang.org/x/arch v0.17.0 // indirect
-	golang.org/x/crypto v0.45.0 // indirect
-	golang.org/x/net v0.47.0 // indirect
-	golang.org/x/sys v0.38.0 // indirect
-	golang.org/x/text v0.31.0 // indirect
+	golang.org/x/crypto v0.52.0 // indirect
+	golang.org/x/net v0.55.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
 	google.golang.org/protobuf v1.36.6 // indirect
-	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 )

go.sum

@@ -67,15 +67,15 @@ github.com/ugorji/go/codec v1.2.12 h1:9LC83zGrHhuUA9l16C9AHXAqEV/2wBQ4nkvumAE65E
 github.com/ugorji/go/codec v1.2.12/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
 golang.org/x/arch v0.17.0 h1:4O3dfLzd+lQewptAHqjewQZQDyEdejz3VwgeYwkZneU=
 golang.org/x/arch v0.17.0/go.mod h1:bdwinDaKcfZUGpH09BB7ZmOfhalA8lQdzl62l8gGWsk=
-golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
-golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
-golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
-golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
+golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
-golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
-golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=

internal/static/nodejs_syscall/syscalls_amd64.go

@@ -5,16 +5,18 @@ package nodejs_syscall
 import "syscall"
 
 const (
-	//334
-	SYS_RSEQ = 334
-	// 435
-	SYS_CLONE3 = 435
+	SYS_RSEQ       = 334
+	SYS_CLONE3     = 435
+	SYS_MEMBARRIER = 324
+	SYS_PRCTL      = 157
+	SYS_STATX      = 332
+	SYS_GETRANDOM  = 318
 )
 
 var ALLOW_SYSCALLS = []int{
 	syscall.SYS_OPEN, syscall.SYS_WRITE, syscall.SYS_CLOSE, syscall.SYS_READ,
 	syscall.SYS_OPENAT, syscall.SYS_NEWFSTATAT, syscall.SYS_IOCTL, syscall.SYS_LSEEK,
-	syscall.SYS_FSTAT,
+	syscall.SYS_FSTAT, SYS_STATX,
 	syscall.SYS_MPROTECT, syscall.SYS_MMAP, syscall.SYS_MUNMAP,
 	syscall.SYS_MREMAP,
 	syscall.SYS_BRK,
@@ -23,11 +25,11 @@ var ALLOW_SYSCALLS = []int{
 	syscall.SYS_FCNTL, syscall.SYS_SIGALTSTACK, syscall.SYS_RT_SIGRETURN,
 	syscall.SYS_FUTEX,
 	syscall.SYS_EXIT_GROUP,
-	syscall.SYS_EPOLL_CTL,
+	syscall.SYS_EPOLL_CREATE1, syscall.SYS_EPOLL_CTL,
 	syscall.SYS_EPOLL_PWAIT,
 	syscall.SYS_SCHED_YIELD, syscall.SYS_EXIT,
-	syscall.SYS_SCHED_GETAFFINITY, syscall.SYS_SET_ROBUST_LIST,
-	SYS_RSEQ,
+	syscall.SYS_SCHED_GETAFFINITY, syscall.SYS_SET_ROBUST_LIST, syscall.SYS_GET_ROBUST_LIST,
+	SYS_RSEQ, SYS_MEMBARRIER, SYS_PRCTL,
 
 	syscall.SYS_SETGROUPS, syscall.SYS_SETGID, syscall.SYS_SETUID, syscall.SYS_GETTID,
 
@@ -38,6 +40,8 @@ var ALLOW_SYSCALLS = []int{
 
 	syscall.SYS_READLINK,
 	syscall.SYS_DUP3,
+
+	SYS_GETRANDOM,
 }
 
 var ALLOW_ERROR_SYSCALLS = []int{

internal/static/nodejs_syscall/syscalls_arm64.go

@@ -4,33 +4,46 @@ package nodejs_syscall
 
 import "syscall"
 
+const (
+	SYS_CLONE3     = 435
+	SYS_MEMBARRIER = 283
+	SYS_PRCTL      = 167
+	SYS_STATX      = 291
+)
+
 var ALLOW_SYSCALLS = []int{
 	// file
 	syscall.SYS_CLOSE, syscall.SYS_WRITE, syscall.SYS_READ,
-	syscall.SYS_FSTAT, syscall.SYS_FCNTL,
+	syscall.SYS_FSTAT, syscall.SYS_FCNTL, SYS_STATX,
 	syscall.SYS_READLINKAT, syscall.SYS_OPENAT,
 
 	// process
 	syscall.SYS_GETPID, syscall.SYS_TGKILL, syscall.SYS_FUTEX, syscall.SYS_IOCTL,
 	syscall.SYS_EXIT, syscall.SYS_EXIT_GROUP,
-	syscall.SYS_SET_ROBUST_LIST, syscall.SYS_NANOSLEEP, syscall.SYS_SCHED_GETAFFINITY,
-	syscall.SYS_SCHED_YIELD,
+	syscall.SYS_SET_ROBUST_LIST, syscall.SYS_GET_ROBUST_LIST, syscall.SYS_NANOSLEEP, syscall.SYS_SCHED_GETAFFINITY,
+	syscall.SYS_SCHED_YIELD, SYS_PRCTL,
 
 	// memory
 	syscall.SYS_RT_SIGPROCMASK, syscall.SYS_SIGALTSTACK, syscall.SYS_RT_SIGACTION,
 	syscall.SYS_MMAP, syscall.SYS_MUNMAP, syscall.SYS_MADVISE, syscall.SYS_MPROTECT,
-	syscall.SYS_RT_SIGRETURN, syscall.SYS_BRK,
+	syscall.SYS_RT_SIGRETURN, syscall.SYS_BRK, syscall.SYS_MREMAP, SYS_MEMBARRIER,
+
+	// time
+	syscall.SYS_CLOCK_GETTIME, syscall.SYS_GETTIMEOFDAY,
 
 	//user/group
 	syscall.SYS_SETGROUPS, syscall.SYS_SETGID, syscall.SYS_SETUID, syscall.SYS_GETTID,
 	syscall.SYS_GETUID, syscall.SYS_GETGID,
 
 	// epoll
-	syscall.SYS_EPOLL_CTL, syscall.SYS_EPOLL_PWAIT,
+	syscall.SYS_EPOLL_CREATE1, syscall.SYS_EPOLL_CTL, syscall.SYS_EPOLL_PWAIT,
+
+	// random
+	syscall.SYS_GETRANDOM,
 }
 
 var ALLOW_ERROR_SYSCALLS = []int{
-	syscall.SYS_CLONE, 293,
+	syscall.SYS_CLONE, SYS_CLONE3, 293,
 }
 
 var ALLOW_NETWORK_SYSCALLS = []int{

internal/static/python_syscall/syscalls_amd64.go

@@ -5,29 +5,33 @@ package python_syscall
 import "syscall"
 
 const (
-	SYS_GETRANDOM = 318
-	SYS_RSEQ      = 334
-	SYS_SENDMMSG  = 307
+	SYS_GETRANDOM  = 318
+	SYS_RSEQ       = 334
+	SYS_SENDMMSG   = 307
+	SYS_CLONE3     = 435
+	SYS_MEMBARRIER = 324
+	SYS_PRCTL      = 157
+	SYS_STATX      = 332
 )
 
 var ALLOW_SYSCALLS = []int{
 	// file io
 	syscall.SYS_NEWFSTATAT, syscall.SYS_FSTAT, syscall.SYS_FCNTL, syscall.SYS_IOCTL, syscall.SYS_LSEEK, syscall.SYS_GETDENTS64,
-	syscall.SYS_WRITE, syscall.SYS_CLOSE, syscall.SYS_OPENAT, syscall.SYS_READ,
+	syscall.SYS_WRITE, syscall.SYS_CLOSE, syscall.SYS_OPENAT, syscall.SYS_READ, syscall.SYS_READLINK, SYS_STATX,
 	// thread
 	syscall.SYS_FUTEX,
 	// memory
 	syscall.SYS_MMAP, syscall.SYS_BRK, syscall.SYS_MPROTECT, syscall.SYS_MUNMAP, syscall.SYS_RT_SIGRETURN,
-	syscall.SYS_MREMAP,
+	syscall.SYS_MREMAP, syscall.SYS_MADVISE, SYS_MEMBARRIER,
 
 	// user/group
 	syscall.SYS_SETGROUPS, syscall.SYS_SETGID, syscall.SYS_SETUID, syscall.SYS_GETUID,
 	// process
 	syscall.SYS_GETPID, syscall.SYS_GETPPID, syscall.SYS_GETTID,
 	syscall.SYS_EXIT, syscall.SYS_EXIT_GROUP,
 	syscall.SYS_TGKILL, syscall.SYS_RT_SIGACTION, syscall.SYS_IOCTL,
-	syscall.SYS_SCHED_YIELD,
-	syscall.SYS_SET_ROBUST_LIST, syscall.SYS_GET_ROBUST_LIST, SYS_RSEQ,
+	syscall.SYS_SCHED_YIELD, syscall.SYS_SCHED_GETAFFINITY,
+	syscall.SYS_SET_ROBUST_LIST, syscall.SYS_GET_ROBUST_LIST, SYS_RSEQ, SYS_PRCTL,
 
 	// time
 	syscall.SYS_CLOCK_GETTIME, syscall.SYS_GETTIMEOFDAY, syscall.SYS_NANOSLEEP,
@@ -39,7 +43,7 @@ var ALLOW_SYSCALLS = []int{
 }
 
 var ALLOW_ERROR_SYSCALLS = []int{
-	syscall.SYS_CLONE,
+	syscall.SYS_CLONE, SYS_CLONE3,
 	syscall.SYS_MKDIRAT,
 	syscall.SYS_MKDIR,
 }

internal/static/python_syscall/syscalls_arm64.go

@@ -7,20 +7,24 @@ import (
 )
 
 const (
-	SYS_RSEQ = 293
+	SYS_RSEQ       = 293
+	SYS_CLONE3     = 435
+	SYS_MEMBARRIER = 283
+	SYS_PRCTL      = 167
+	SYS_STATX      = 291
 )
 
 var ALLOW_SYSCALLS = []int{
 	// file io
 	syscall.SYS_WRITE, syscall.SYS_CLOSE, syscall.SYS_OPENAT, syscall.SYS_READ, syscall.SYS_LSEEK, syscall.SYS_GETDENTS64,
-	syscall.SYS_FSTAT, syscall.SYS_FCNTL,
+	syscall.SYS_FSTAT, syscall.SYS_FCNTL, syscall.SYS_READLINKAT, SYS_STATX,
 
 	// thread
 	syscall.SYS_FUTEX,
 
 	// memory
 	syscall.SYS_MMAP, syscall.SYS_BRK, syscall.SYS_MPROTECT, syscall.SYS_MUNMAP, syscall.SYS_RT_SIGRETURN, syscall.SYS_RT_SIGPROCMASK,
-	syscall.SYS_SIGALTSTACK, syscall.SYS_MREMAP,
+	syscall.SYS_SIGALTSTACK, syscall.SYS_MREMAP, syscall.SYS_MADVISE, SYS_MEMBARRIER,
 
 	// user/group
 	syscall.SYS_SETGROUPS, syscall.SYS_SETGID, syscall.SYS_SETUID, syscall.SYS_GETUID,
@@ -29,9 +33,9 @@ var ALLOW_SYSCALLS = []int{
 	syscall.SYS_GETPID, syscall.SYS_GETPPID, syscall.SYS_GETTID,
 	syscall.SYS_EXIT, syscall.SYS_EXIT_GROUP,
 	syscall.SYS_TGKILL, syscall.SYS_RT_SIGACTION,
-	syscall.SYS_IOCTL, syscall.SYS_SCHED_YIELD,
+	syscall.SYS_IOCTL, syscall.SYS_SCHED_YIELD, syscall.SYS_SCHED_GETAFFINITY,
 	syscall.SYS_GET_ROBUST_LIST, syscall.SYS_SET_ROBUST_LIST,
-	SYS_RSEQ,
+	SYS_RSEQ, SYS_PRCTL,
 
 	// time
 	syscall.SYS_EPOLL_CREATE1,
@@ -44,7 +48,7 @@ var ALLOW_SYSCALLS = []int{
 }
 
 var ALLOW_ERROR_SYSCALLS = []int{
-	syscall.SYS_CLONE,
+	syscall.SYS_CLONE, SYS_CLONE3,
 	syscall.SYS_MKDIRAT,
 }