Class: Hermetic::Backends::Gvisor

Inherits:
Docker show all
Defined in:
lib/hermetic/backends/gvisor.rb

Overview

gVisor: Docker's hardened front-end, but the container runs under the runsc user-space kernel — a real syscall boundary instead of shared host-kernel namespaces. Still trust :host: the isolation is stronger, but the daemon this adapter shells to lives on the app host — isolation strength and trust domain are independent axes (spec §3).

Constant Summary collapse

RUNSC = 
"runsc"

Constants inherited from Base

Base::OFF_HOST_TRUST, Base::TIMEOUT_EXIT

Instance Attribute Summary

Attributes inherited from Docker

#image, #workdir

Attributes inherited from Base

#limits, #trust

Instance Method Summary collapse

Methods inherited from Docker

#bootstrap_script, #container_argv

Methods inherited from Base

#backend_name, #enabled?, #off_host?, #run

Methods included from SilasLedgerGuard

#run

Constructor Details

#initialize(image:, runtime: RUNSC, **opts) ⇒ Gvisor

Returns a new instance of Gvisor.



13
14
15
16
 
# File 'lib/hermetic/backends/gvisor.rb', line 13

def initialize(image:, runtime: RUNSC, **opts)
  super(image: image, **opts)
  @runtime = runtime
end