mirror of
https://github.com/hanzoai/runtime.git
synced 2026-10-30 18:23:13 +00:00
zeekayandHanzo Dev
a386271c80
Every sandbox was created privileged under the daemon's default runtime, and the setting that would have changed it defaulted to an empty string that silently meant runc. For a service whose whole premise is running code somebody else wrote, that is not a boundary. An org sets its isolation and the create request carries it, so a sandbox records what it was made with: changing the policy moves new sandboxes and leaves running ones alone. gvisor is the default. firecracker is delivered through kata's shim, which is why it is one name rather than two. runc is refused unless the runner names that org, and an empty list names nobody. Absent means the default, unknown is a refusal, and a runtime the daemon does not have is a refusal. Nothing substitutes quietly. The runner took an organization in a field called UserId with a note beside it saying so. Deciding who may have runc through a field named after something else is not reviewable. Privileged is replaced by dropping everything and granting the eight the daemon uses. Nothing the sandbox does broke; what stopped working is mount, mknod, raw sockets, chroot, writing to proc, and seeing the host's disks. AUDIT_WRITE is among them because without it sudo works and complains every time. The creation histogram's lowest bucket was a tenth of a second, so the metric could not observe the claim the product makes about its own speed. It can now, and it carries the isolation, so comparing them is a query. Co-authored-by: Hanzo Dev <[email protected]>
110 lines
4.8 KiB
AMPL
110 lines
4.8 KiB
AMPL
module github.com/hanzoai/runtime/apps/runner
|
|
|
|
go 1.26.4
|
|
|
|
require (
|
|
github.com/docker/docker v27.5.1+incompatible
|
|
github.com/gin-gonic/gin v1.10.1
|
|
github.com/go-playground/validator/v10 v10.26.0
|
|
github.com/gorilla/websocket v1.5.3
|
|
github.com/joho/godotenv v1.5.1
|
|
github.com/kelseyhightower/envconfig v1.4.0
|
|
github.com/minio/minio-go/v7 v7.0.91
|
|
github.com/prometheus/client_golang v1.21.1
|
|
github.com/rs/zerolog v1.33.0
|
|
github.com/sirupsen/logrus v1.9.3
|
|
github.com/swaggo/files v1.0.1
|
|
github.com/swaggo/gin-swagger v1.6.0
|
|
github.com/swaggo/swag v1.16.3
|
|
)
|
|
|
|
require (
|
|
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
|
|
github.com/KyleBanks/depth v1.2.1 // indirect
|
|
github.com/Microsoft/go-winio v0.6.2 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/bytedance/sonic v1.13.2 // indirect
|
|
github.com/bytedance/sonic/loader v0.2.4 // indirect
|
|
github.com/cenkalti/backoff v2.2.1+incompatible // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/cloudflare/circl v1.6.3 // indirect
|
|
github.com/cloudwego/base64x v0.1.5 // indirect
|
|
github.com/containerd/log v0.1.0 // indirect
|
|
github.com/creack/pty v1.1.23 // indirect
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
github.com/distribution/reference v0.6.0 // indirect
|
|
github.com/docker/go-connections v0.5.0 // indirect
|
|
github.com/docker/go-units v0.5.0 // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/gabriel-vasile/mimetype v1.4.8 // indirect
|
|
github.com/gin-contrib/sse v1.0.0 // indirect
|
|
github.com/go-ini/ini v1.67.0 // indirect
|
|
github.com/go-logr/logr v1.4.3 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/go-openapi/jsonpointer v0.21.0 // indirect
|
|
github.com/go-openapi/jsonreference v0.21.0 // indirect
|
|
github.com/go-openapi/spec v0.21.0 // indirect
|
|
github.com/go-openapi/swag v0.23.0 // indirect
|
|
github.com/go-playground/locales v0.14.1 // indirect
|
|
github.com/go-playground/universal-translator v0.18.1 // indirect
|
|
github.com/goccy/go-json v0.10.5 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/google/go-cmp v0.7.0 // indirect
|
|
github.com/google/uuid v1.6.0 // indirect
|
|
github.com/gorilla/rpc v1.2.1 // indirect
|
|
github.com/grandcat/zeroconf v1.0.0 // indirect
|
|
github.com/josharian/intern v1.0.0 // indirect
|
|
github.com/json-iterator/go v1.1.12 // indirect
|
|
github.com/klauspost/compress v1.18.6 // indirect
|
|
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
|
|
github.com/leodido/go-urn v1.4.0 // indirect
|
|
github.com/luxfi/accel v1.2.4 // indirect
|
|
github.com/luxfi/crypto v1.20.2 // indirect
|
|
github.com/luxfi/mdns v0.1.1 // indirect
|
|
github.com/luxfi/metric v1.10.1 // indirect
|
|
github.com/luxfi/zap v1.2.6 // indirect
|
|
github.com/mailru/easyjson v0.7.7 // indirect
|
|
github.com/mattn/go-colorable v0.1.14 // indirect
|
|
github.com/mattn/go-isatty v0.0.21 // indirect
|
|
github.com/miekg/dns v1.1.72 // indirect
|
|
github.com/minio/crc64nvme v1.0.1 // indirect
|
|
github.com/minio/md5-simd v1.1.2 // indirect
|
|
github.com/moby/docker-image-spec v1.3.1 // indirect
|
|
github.com/moby/term v0.5.2 // indirect
|
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
|
github.com/modern-go/reflect2 v1.0.2 // indirect
|
|
github.com/morikuni/aec v1.0.0 // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/opencontainers/go-digest v1.0.0 // indirect
|
|
github.com/opencontainers/image-spec v1.1.0 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.2.3 // indirect
|
|
github.com/pkg/errors v0.9.1 // indirect
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
|
github.com/prometheus/client_model v0.6.1 // indirect
|
|
github.com/prometheus/common v0.62.0 // indirect
|
|
github.com/prometheus/procfs v0.15.1 // indirect
|
|
github.com/rs/xid v1.6.0 // indirect
|
|
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
|
|
github.com/ugorji/go/codec v1.2.12 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 // indirect
|
|
go.opentelemetry.io/otel v1.44.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.34.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.44.0 // indirect
|
|
go.opentelemetry.io/otel/sdk v1.44.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.44.0 // indirect
|
|
golang.org/x/arch v0.16.0 // indirect
|
|
golang.org/x/crypto v0.52.0 // indirect
|
|
golang.org/x/mod v0.36.0 // indirect
|
|
golang.org/x/net v0.55.0 // indirect
|
|
golang.org/x/sync v0.20.0 // indirect
|
|
golang.org/x/sys v0.45.0 // indirect
|
|
golang.org/x/text v0.37.0 // indirect
|
|
golang.org/x/time v0.10.0 // indirect
|
|
golang.org/x/tools v0.45.0 // indirect
|
|
google.golang.org/protobuf v1.36.11 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
gotest.tools/v3 v3.5.1 // indirect
|
|
)
|