Class: Hermetic::Backends::Base

Inherits:
Object
  • Object
show all
Includes:
SilasLedgerGuard
Defined in:
lib/hermetic/backends/base.rb

Overview

Shared plumbing for every backend: normalize the run kwargs into a Request, delegate to the subclass's #execute (-> [stdout, stderr, exit_status, timed_out]), assemble the Result. Timeout always maps to exit 124 here so no backend can disagree about the convention.

Direct Known Subclasses

Docker, Firecracker, Hosted::E2B, Null, Remote

Constant Summary collapse

TIMEOUT_EXIT =

coreutils convention, matches Silas

124
OFF_HOST_TRUST = 
%i[vendor remote].freeze

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(trust:, limits: nil, credentials: nil, credential_mode: :env, env_allowlist: []) ⇒ Base

Returns a new instance of Base.



14
15
16
17
18
19
 
# File 'lib/hermetic/backends/base.rb', line 14

def initialize(trust:, limits: nil, credentials: nil, credential_mode: :env, env_allowlist: [])
  @trust = trust
  @limits = Limits.build(limits)
  @credentials = Credentials.build(credentials, mode: credential_mode)
  @env_allowlist = Array(env_allowlist).map(&:to_s)
end

Instance Attribute Details

#limits ⇒ Object (readonly)

Returns the value of attribute limits.



12
13
14
 
# File 'lib/hermetic/backends/base.rb', line 12

def limits
  @limits
end

#trust ⇒ Object (readonly)

Returns the value of attribute trust.



12
13
14
 
# File 'lib/hermetic/backends/base.rb', line 12

def trust
  @trust
end

Instance Method Details

#backend_name ⇒ Object 



41
 
# File 'lib/hermetic/backends/base.rb', line 41

def backend_name = self.class.name.split("::").last.gsub(/([a-z\d])([A-Z])/, '\1_\2').downcase.to_sym

#enabled? ⇒ Boolean

Returns:

  • (Boolean) 


21
 
# File 'lib/hermetic/backends/base.rb', line 21

def enabled? = true

#off_host? ⇒ Boolean

Off-host = a guest escape cannot reach the app's secrets (spec §3). Co-location is a visible, refusable property — guard with:

raise "untrusted code requires an off-host sandbox" unless box.off_host?

Returns:

  • (Boolean) 


26
 
# File 'lib/hermetic/backends/base.rb', line 26

def off_host? = OFF_HOST_TRUST.include?(trust)

#run(command, files: {}, stdin: nil, env: {}, network: :none, timeout: 30, limits: nil) ⇒ Object 



28
29
30
31
32
33
34
35
36
37
38
39
 
# File 'lib/hermetic/backends/base.rb', line 28

def run(command, files: {}, stdin: nil, env: {}, network: :none, timeout: 30, limits: nil)
  request = Request.build(command, files: files, stdin: stdin, env: env,
                          network: network, timeout: timeout, limits: limits,
                          default_limits: @limits, credentials: @credentials,
                          env_allowlist: @env_allowlist)
  started = clock_ms
  stdout, stderr, exit_status, timed_out = execute(request)
  exit_status = TIMEOUT_EXIT if timed_out
  Result.new(stdout: stdout, stderr: stderr, exit_status: exit_status,
             timed_out: !!timed_out, duration_ms: clock_ms - started,
             backend: backend_name, trust: trust)
end