sandbox

Documentation

Overview

Package nsjail contains a local copy of nsjail.

Package sandbox provides capabilities for sandboxing subprocesses.

Index

• type Config
• type Mount
• type Sandbox
  • func New(tempDir string) (Sandbox, error)

Types

type Config

type Config struct {
	// The subprocess command line.
	Cmd          []string
	Cwd          string
	AllowNetwork bool
	Env          map[string]string
	Mounts       []Mount
	// contains filtered or unexported fields
}

Config represents the configuration for a sandboxed subprocess.

type Mount

type Mount struct {
	// Path outside the nsjail that should be mounted inside the nsjail.
	Path string
	// Dest is the optional location to mount in the nsjail. If omitted, it will
	// be assumed to be the same as Path.
	Dest string
	// Writable controls whether the mount is writable by processes within the
	// nsjail.
	Writable bool
}

Mount represents a directory or file from the filesystem to mount inside the nsjail so that processes inside the nsjail can access it.

type Sandbox

type Sandbox interface {
	Command(context.Context, *Config) *exec.Cmd
}

func New

func New(tempDir string) (Sandbox, error)

New constructs a platform-appropriate sandbox.