Module: Insika::Sandbox

Defined in:
lib/insika/sandbox.rb,
lib/insika/sandbox/local.rb,
lib/insika/sandbox/docker.rb,
lib/insika/sandbox/runner.rb,
lib/insika/sandbox/boundary.rb

Overview

Sandbox primitive (item 35 / COMPETITIVE-ANALYSIS §4.6): a single, pluggable interface for confined execution, promoted to the core from the insika-code prototype. Two halves:

* FS confinement (`Boundary`) — ALWAYS host-side, always on: every path a
tool resolves is proven inside the root before any IO.
* command exec — via a swappable PROVIDER: `local` (in-process, the default)
or `docker` (isolated container). Providers are chosen by DATA, not code
(config-over-code): the agent profile's `sandbox` block names the provider
and its policy.

Env is the object a tool holds; Sandbox.build(config) assembles one from the declarative config (the same hash shape stored on the profile).

Defined Under Namespace

Modules: Runner Classes: Boundary, Docker, Env, Local, Result

Constant Summary collapse

Escape =

Ergonomic alias so tools can rescue Insika::Sandbox::Escape without reaching into the Boundary. It IS Boundary::Escape (same class).

Boundary::Escape
DEFAULT_TIMEOUT = 
120
DEFAULT_MAX_OUTPUT = 
40_000

Class Method Summary collapse

Class Method Details

.build(config = {}) ⇒ Object

config keys (all optional, string or symbol):

provider    "local" (default) | "docker"
root        confinement root (default: Dir.pwd)
timeout     per-exec wall-clock seconds (default 120)
max_output  bytes of combined output kept (default 40_000)
+ provider-specific keys (image/network/memory/cpus/... for docker)


39
40
41
42
43
44
45
46
47
48
 
# File 'lib/insika/sandbox.rb', line 39

def build(config = {})
  cfg  = Coercion.deep_stringify(config || {})
  root = cfg["root"].to_s.empty? ? Dir.pwd : cfg["root"]
  Env.new(
    boundary: Boundary.new(root),
    provider: provider_for(cfg),
    timeout: Integer(cfg["timeout"] || DEFAULT_TIMEOUT),
    max_output: Integer(cfg["max_output"] || DEFAULT_MAX_OUTPUT)
  )
end

.provider_for(cfg) ⇒ Object 



50
51
52
53
54
55
56
 
# File 'lib/insika/sandbox.rb', line 50

def provider_for(cfg)
  case cfg["provider"].to_s
  when "", "local" then Local.new(shell: cfg["shell"] || "/bin/bash")
  when "docker"     then Docker.new(cfg)
  else raise ArgumentError, "unknown sandbox provider: #{cfg["provider"].inspect}"
  end
end