mirror of
https://github.com/hanzoai/runtime.git
synced 2026-10-30 18:23:13 +00:00
zeekayandHanzo Dev
a386271c80
Every sandbox was created privileged under the daemon's default runtime, and the setting that would have changed it defaulted to an empty string that silently meant runc. For a service whose whole premise is running code somebody else wrote, that is not a boundary. An org sets its isolation and the create request carries it, so a sandbox records what it was made with: changing the policy moves new sandboxes and leaves running ones alone. gvisor is the default. firecracker is delivered through kata's shim, which is why it is one name rather than two. runc is refused unless the runner names that org, and an empty list names nobody. Absent means the default, unknown is a refusal, and a runtime the daemon does not have is a refusal. Nothing substitutes quietly. The runner took an organization in a field called UserId with a note beside it saying so. Deciding who may have runc through a field named after something else is not reviewable. Privileged is replaced by dropping everything and granting the eight the daemon uses. Nothing the sandbox does broke; what stopped working is mount, mknod, raw sockets, chroot, writing to proc, and seeing the host's disks. AUDIT_WRITE is among them because without it sudo works and complains every time. The creation histogram's lowest bucket was a tenth of a second, so the metric could not observe the claim the product makes about its own speed. It can now, and it carries the isolation, so comparing them is a query. Co-authored-by: Hanzo Dev <[email protected]>
61 lines
2.6 KiB
AMPL
61 lines
2.6 KiB
AMPL
module github.com/hanzoai/runtime/libs/computer-use
|
|
|
|
go 1.26.4
|
|
|
|
require (
|
|
github.com/go-vgo/robotgo v0.110.8
|
|
github.com/hashicorp/go-hclog v1.6.3
|
|
github.com/hashicorp/go-plugin v1.6.3
|
|
github.com/kbinani/screenshot v0.0.0-20250118074034-a3924b7bbc8c
|
|
github.com/sirupsen/logrus v1.9.3
|
|
github.com/stretchr/testify v1.10.0
|
|
)
|
|
|
|
require (
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
github.com/dblohm7/wingoes v0.0.0-20250611174154-e3e096948d18 // indirect
|
|
github.com/ebitengine/purego v0.8.4 // indirect
|
|
github.com/fatih/color v1.13.0 // indirect
|
|
github.com/gen2brain/shm v0.1.1 // indirect
|
|
github.com/go-ole/go-ole v1.3.0 // indirect
|
|
github.com/godbus/dbus/v5 v5.1.0 // indirect
|
|
github.com/golang/protobuf v1.5.4 // indirect
|
|
github.com/hashicorp/yamux v0.1.1 // indirect
|
|
github.com/jezek/xgb v1.1.1 // indirect
|
|
github.com/kr/pretty v0.3.1 // indirect
|
|
github.com/lufia/plan9stats v0.0.0-20250317134145-8bc96cf8fc35 // indirect
|
|
github.com/lxn/win v0.0.0-20210218163916-a377121e959e // indirect
|
|
github.com/mattn/go-colorable v0.1.13 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/oklog/run v1.0.0 // indirect
|
|
github.com/otiai10/gosseract v2.2.1+incompatible // indirect
|
|
github.com/otiai10/mint v1.6.3 // indirect
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
|
github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
|
|
github.com/robotn/xgb v0.10.0 // indirect
|
|
github.com/robotn/xgbutil v0.10.0 // indirect
|
|
github.com/rogpeppe/go-internal v1.13.1 // indirect
|
|
github.com/shirou/gopsutil/v4 v4.25.5 // indirect
|
|
github.com/tailscale/win v0.0.0-20250213223159-5992cb43ca35 // indirect
|
|
github.com/tklauser/go-sysconf v0.3.15 // indirect
|
|
github.com/tklauser/numcpus v0.10.0 // indirect
|
|
github.com/vcaesar/gops v0.41.0 // indirect
|
|
github.com/vcaesar/imgo v0.41.0 // indirect
|
|
github.com/vcaesar/keycode v0.10.1 // indirect
|
|
github.com/vcaesar/screenshot v0.11.1 // indirect
|
|
github.com/vcaesar/tt v0.20.1 // indirect
|
|
github.com/yusufpapurcu/wmi v1.2.4 // indirect
|
|
go.opentelemetry.io/otel v1.34.0 // indirect
|
|
go.opentelemetry.io/otel/sdk v1.34.0 // indirect
|
|
golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect
|
|
golang.org/x/image v0.28.0 // indirect
|
|
golang.org/x/net v0.41.0 // indirect
|
|
golang.org/x/sys v0.33.0 // indirect
|
|
golang.org/x/text v0.26.0 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f // indirect
|
|
google.golang.org/grpc v1.69.4 // indirect
|
|
google.golang.org/protobuf v1.36.6 // indirect
|
|
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
)
|