Make SourceHunt sandbox execution pluggable - #200
Merged
Conversation
ropoctl
changed the title
- Docker "enhanced" isolation honors the operator-configured gVisor runtime
(e.g. kata-runtime, runsc-kvm) instead of hardcoding "runsc", which could
silently downgrade isolation to plain runc when a validated non-runsc
runtime was requested. The runtime name stays a Docker-adapter detail and
never crosses the neutral SandboxRunConfig or the RPC boundary.
- Buffer the JSON-RPC reader (makefile("rb")) so a large response no longer
forces one recv() per byte, which pinned the shared reader thread and
stalled every concurrent worker.
- Bound the Docker build with a wall-clock watchdog; the previous
read-stdout-to-EOF-then-wait(timeout) path never bounded a build hung with
stdout still open (e.g. a stalled base-image pull).
- Keep the shared JSON-RPC connection alive across one malformed or oversized
response: a well-framed invalid frame fails only its matching call, and an
oversized frame is drained to the next boundary instead of tearing down
every in-flight and future call on the connection.
- Release the socket descriptor on every failure path via reader-thread
teardown, not just the explicit close() path, fixing an fd leak on peer
disconnect.
- Report a non-positive call timeout before writing the request so the backend
does not execute the method's side effects for an already-abandoned call.
Adds regression tests for each fix.
whatever
approved these changes
Sep 3, 2026
whatever
left a comment
whatever
left a comment
Contributor
There was a problem hiding this comment.
lgtm with some minor feedback
Contributor
|
um ok |
Contributor
|
I was literally working on it. |
Contributor
|
never mind then, I guess you got it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The hunter model does not invent environment setup. Build-system detection deterministically maps repository markers to a closed profile and feature vocabulary. Environment preparation is separate from execution: it receives no repository or secrets, while project commands run afterward in a no-network sandbox.
The public start policy is also provider-neutral. It carries SourceHunt policy, semantic isolation level, resource limits, mounts, environment, and working directory; Docker network, seccomp, capability, image, and runtime flags never cross the RPC boundary.
An fd endpoint adopts the inherited connected socket. Clearwing closes that descriptor with the RPC connection, so the supervisor keeps only its side of the socketpair and can reliably observe disconnects.
Version 1 intentionally passes approved host paths and therefore targets local or shared-filesystem supervisors. Arbitrary remote workspace transport remains outside this contract.
Protocol
The backend prepares an environment and returns an opaque provider reference. Clearwing passes that reference back when starting a sandbox and never interprets it as an image, pod, filesystem path, or provider-native identifier.
JSON-RPC methods cover capabilities, capacity, environment ensure/release, sandbox start/exec/stop, file read/write, and tree copy. A single reader thread multiplexes concurrent synchronous calls by request id.
Validation
Repository-wide Ruff and mypy have pre-existing failures outside the changed sandbox files, so they are not claimed as clean here.
Coordination
The repository conflict-check skill was unavailable, so open pull requests were inspected manually. PR #190 has textual overlap in SourceHunt sandbox files for writable-workspace handling, but it does not introduce a competing backend/runtime abstraction.