grainagentmain

Documentation

Overview

`tempest-grain-agent` runs inside the grain's sandbox, and is the first program executed during grain startup. Its file descriptor #3 is a socket over which we can speak capnp to the sandstorm server outside the sandbox.

Any APIs available to the grain which don't actually need privileges the grain doesn't have should ideally be implemented here; this helps us minimize attack surface.

Index

• func Main()
• type Command
  • func (c Command) ToOsCmd() *exec.Cmd

Functions

func Main

func Main()

Types

type Command

type Command struct {
	Args []string
	Env  []string
}

func (Command) ToOsCmd

func (c Command) ToOsCmd() *exec.Cmd