Module: Hermetic

Defined in:
lib/hermetic.rb,
lib/hermetic/silas.rb,
lib/hermetic/errors.rb,
lib/hermetic/limits.rb,
lib/hermetic/remote.rb,
lib/hermetic/result.rb,
lib/hermetic/request.rb,
lib/hermetic/version.rb,
lib/hermetic/credentials.rb,
lib/hermetic/backends/base.rb,
lib/hermetic/backends/null.rb,
lib/hermetic/network_policy.rb,
lib/hermetic/transport/http.rb,
lib/hermetic/backends/docker.rb,
lib/hermetic/backends/gvisor.rb,
lib/hermetic/backends/hosted.rb,
lib/hermetic/backends/hosted/e2b.rb,
lib/hermetic/backends/firecracker.rb,
lib/hermetic/transport/subprocess.rb

Overview

hermetic — the missing Ruby sandbox. One run interface, swappable isolation backends, designed to run off the app host so a guest escape can't reach your secrets. Every constructor returns a plain object implementing run/enabled?, so config.sandbox = Hermetic.gvisor(...) drops into Silas unchanged.

Backends beyond Null are required lazily — constructing one you haven't shipped/installed fails at the constructor, not at boot.

Defined Under Namespace

Modules: Backends, SilasLedgerGuard, Transport Classes: ConfigError, Credentials, DisabledError, Error, Limits, NetworkPolicy, Remote, Request, Result, TimeoutError, TransportError, WorkspaceError

Constant Summary collapse

CLIENT_OPTS =

Options that shape the client-side Request (or the wire itself) and so stay on the Remote client when executor: reroutes a local constructor; everything else is the executor's to construct with (spec §3).

%i[limits credentials credential_mode env_allowlist transport].freeze
VERSION = 
"0.1.0"

Class Method Summary collapse

Class Method Details

.docker(**opts) ⇒ Object 



30
 
# File 'lib/hermetic.rb', line 30

def docker(**opts) = backend(:docker, :Docker, "hermetic/backends/docker", **opts)

.firecracker(**opts) ⇒ Object 



34
 
# File 'lib/hermetic.rb', line 34

def firecracker(**opts) = backend(:firecracker, :Firecracker, "hermetic/backends/firecracker", **opts)

.gvisor(**opts) ⇒ Object 



32
 
# File 'lib/hermetic.rb', line 32

def gvisor(**opts) = backend(:gvisor, :Gvisor, "hermetic/backends/gvisor", **opts)

.hosted(provider, **opts) ⇒ Object 



36
37
38
39
 
# File 'lib/hermetic.rb', line 36

def hosted(provider, **opts)
  require "hermetic/backends/hosted"
  Backends::Hosted.build(provider, **opts)
end

.null ⇒ Object 



28
 
# File 'lib/hermetic.rb', line 28

def null = Backends::Null.new

.wrap(executor:, **opts) ⇒ Object

Off-host executor client (trust :remote): the isolation runs on a dedicated sandbox host; this process holds only the URL + token.



43
44
45
46
 
# File 'lib/hermetic.rb', line 43

def wrap(executor:, **opts)
  require "hermetic/remote"
  Remote.new(executor: executor, **opts)
end