Skip to content

Commit eea758e

Browse files
LutherwavesLutherwaves
committed
feat: openblox
Sandboxes for running untrusted code, as a Go library over Docker and gVisor. No control plane, no database, no scheduler — you import it, you get a sandbox. Create a container on the runsc runtime with no external network interface, exec commands in it with a per-call timeout, read and write files, start detached background processes, and hand out signed, expiring links to a port inside it. A reaper cleans up sandboxes that went idle or got too old. MIT.
0 parents  commit eea758e

46 files changed

Lines changed: 5055 additions & 0 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
name: Bug report
3+
about: Something does not behave as documented
4+
labels: bug
5+
---
6+
7+
**What happened**
8+
9+
**What you expected**
10+
11+
**Reproduction**
12+
13+
```go
14+
// smallest code that shows it
15+
```
16+
17+
**Environment**
18+
- openblox version:
19+
- Go version:
20+
- Docker version:
21+
- gVisor (`runsc --version`):
22+
- Host OS / kernel:
23+
24+
**Logs**
25+
26+
<!-- Do NOT report security vulnerabilities here. See SECURITY.md. -->

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
blank_issues_enabled: true
2+
contact_links:
3+
- name: Security vulnerability
4+
url: https://github.com/blox-eng/openblox/security/advisories/new
5+
about: Report privately. Never open a public issue for a vulnerability.

‎.github/ISSUE_TEMPLATE/feature_request.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
name: Feature request
3+
about: Propose a capability
4+
labels: enhancement
5+
---
6+
7+
**The problem**
8+
<!-- What are you trying to do that openblox makes hard or impossible? -->
9+
10+
**Proposed solution**
11+
12+
**Alternatives considered**
13+
14+
**Scope check**
15+
<!-- openblox is deliberately not a multi-tenant platform: no orgs, auth, billing,
16+
scheduling, snapshot/fork, or multi-host. See the non-goals in ARCHITECTURE.md.
17+
If your request touches those, say why it belongs here rather than in a layer
18+
above openblox. -->

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
**What this changes**
2+
3+
**Why**
4+
5+
**Checklist**
6+
- [ ] Conventional commit title (`feat:`, `fix:`, `docs:`, …)
7+
- [ ] Tests cover the new or changed behaviour
8+
- [ ] Godoc on any new exported symbol
9+
- [ ] `make` passes locally (vet, lint, race tests)
10+
11+
**Security defaults**
12+
- [ ] This PR does not loosen a default, add an isolation fallback, or make an
13+
escape hatch easier to reach.
14+
15+
<!-- If you unchecked that box, describe the threat-model change here. See
16+
CONTRIBUTING.md § Changing security defaults. -->

‎.github/workflows/ci.yml‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [main]
6+
paths-ignore:
7+
- '**.md'
8+
- 'docs/**'
9+
- '.gitignore'
10+
pull_request:
11+
branches: [main]
12+
paths-ignore:
13+
- '**.md'
14+
- 'docs/**'
15+
- '.gitignore'
16+
17+
concurrency:
18+
group: ${{ github.workflow }}-${{ github.ref }}
19+
cancel-in-progress: true
20+
21+
permissions:
22+
contents: read
23+
24+
defaults:
25+
run:
26+
shell: bash
27+
28+
jobs:
29+
conventional-commits:
30+
name: Conventional Commits Check
31+
runs-on: ubuntu-latest
32+
timeout-minutes: 5
33+
steps:
34+
- name: Conventional Commits
35+
uses: webiny/action-conventional-commits@7f91b1595ca1951cdb671ddc9f07a49081ec5b69 # v1.4.2
36+
with:
37+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
38+
allowed-commit-types: "feat,fix,cicd,chore,patch,release,test,docs,refactor,ci,dev,perf,build,revert"
39+
40+
lint:
41+
name: Lint
42+
runs-on: ubuntu-latest
43+
needs: conventional-commits
44+
timeout-minutes: 10
45+
steps:
46+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
47+
with:
48+
fetch-depth: 1
49+
persist-credentials: false
50+
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
51+
with:
52+
go-version-file: go.mod
53+
cache: true
54+
- name: go vet
55+
run: go vet ./...
56+
- name: golangci-lint
57+
uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
58+
with:
59+
version: v2.12.2
60+
args: --timeout=5m
61+
skip-cache: true
62+
skip-save-cache: true
63+
env:
64+
GOPROXY: https://proxy.golang.org,direct
65+
66+
test:
67+
name: Test
68+
runs-on: ubuntu-latest
69+
needs: lint
70+
timeout-minutes: 10
71+
steps:
72+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
73+
with:
74+
fetch-depth: 1
75+
persist-credentials: false
76+
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
77+
with:
78+
go-version-file: go.mod
79+
cache: true
80+
# The race detector requires cgo, so it is enabled here even though the
81+
# library itself needs none. The integration-build job below pins
82+
# CGO_ENABLED=0 to prove no cgo dependency creeps into the build.
83+
- name: Run tests
84+
env:
85+
CGO_ENABLED: '1'
86+
run: go test -race -cover -v ./...
87+
88+
# Integration tests need a gVisor-capable host, which hosted runners are not.
89+
# Compiling them on every PR is what stops them rotting between the rare runs
90+
# on a self-hosted box — a test that no longer builds is a test nobody runs.
91+
integration-build:
92+
name: Integration Tests (compile only)
93+
runs-on: ubuntu-latest
94+
needs: lint
95+
timeout-minutes: 10
96+
steps:
97+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
98+
with:
99+
fetch-depth: 1
100+
persist-credentials: false
101+
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
102+
with:
103+
go-version-file: go.mod
104+
cache: true
105+
- name: Compile integration tests
106+
env:
107+
CGO_ENABLED: '0'
108+
run: go build -tags integration ./... && go vet -tags integration ./...

‎.github/workflows/release.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: Release
2+
3+
# Tags a semver release from conventional commits once CI is green on main.
4+
#
5+
# For a Go module a tag *is* the release — there is no registry to publish to,
6+
# so this stays useful while the repository is private: consumers can require a
7+
# real version instead of a commit pseudo-version. No goreleaser hook yet; there
8+
# are no binaries to ship until cmd/openbloxd exists.
9+
on:
10+
workflow_run:
11+
workflows: [CI]
12+
branches: [main]
13+
types:
14+
- completed
15+
16+
concurrency:
17+
group: release-${{ github.ref }}
18+
cancel-in-progress: false
19+
20+
permissions:
21+
contents: read
22+
23+
defaults:
24+
run:
25+
shell: bash
26+
27+
jobs:
28+
release:
29+
name: Create Release
30+
# workflow_run fires regardless of the triggering run's result.
31+
if: ${{ github.event.workflow_run.conclusion == 'success' }}
32+
runs-on: ubuntu-latest
33+
timeout-minutes: 15
34+
permissions:
35+
contents: write
36+
steps:
37+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
38+
with:
39+
fetch-depth: 0
40+
persist-credentials: false
41+
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
42+
with:
43+
go-version-file: go.mod
44+
cache: true
45+
- name: Create Release
46+
uses: go-semantic-release/action@2e9dc4247a6004f8377781bef4cb9dad273a741f # v1.24.1
47+
with:
48+
changelog-file: CHANGELOG.md
49+
allow-initial-development-versions: true
50+
prepend: true
51+
env:
52+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.gitignore‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# If you prefer the allow list template instead of the deny list, see community template:
2+
# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
3+
#
4+
# Binaries for programs and plugins
5+
*.exe
6+
*.exe~
7+
*.dll
8+
*.so
9+
*.dylib
10+
11+
# Test binary, built with `go test -c`
12+
*.test
13+
14+
# Code coverage profiles and other test artifacts
15+
*.out
16+
coverage.*
17+
*.coverprofile
18+
profile.cov
19+
20+
# Dependency directories (remove the comment below to include it)
21+
# vendor/
22+
23+
# Go workspace file
24+
go.work
25+
go.work.sum
26+
27+
# env file
28+
.env
29+
30+
# Editor/IDE
31+
# .idea/
32+
# .vscode/

‎.golangci.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
version: "2"
2+
3+
run:
4+
timeout: 5m
5+
6+
linters:
7+
default: standard # errcheck, govet, ineffassign, staticcheck, unused
8+
enable:
9+
- bodyclose
10+
- errorlint
11+
- gosec
12+
- misspell
13+
- revive
14+
exclusions:
15+
rules:
16+
# Test code may ignore errors and use weak randomness freely.
17+
- path: _test\.go
18+
linters: [errcheck, gosec]
19+
20+
formatters:
21+
enable:
22+
- gofmt
23+
- goimports

0 commit comments

Comments
 (0)