contract.go RawHistoryFolder

1// SPDX-License-Identifier: MIT
2
3package sandbox
4
5import "os"
6
7// The host/guest contract shared by the drivers and the guest side
8// (internal/guest). Changing a value here changes both sides at once because
9// the host always attaches its own executable to the sandbox.
10const (
11	// VsockPort is the vsock port the executor connects to on the host (CID 2).
12	VsockPort = 1024
13	// GuestExecDir and GuestExecName locate the runner executable inside the
14	// sandbox (read-only), in both modes.
15	GuestExecDir  = "/opt/ermite"
16	GuestExecName = "ermite-runner"
17	// ContainerRunDir is the per-job directory bind-mounted into containers;
18	// ContainerSocket is the executor stream socket inside it.
19	ContainerRunDir = "/run/ermite"
20	ContainerSocket = "exec.sock"
21	// GuestExternalsDir is where the host's external tools (Node.js) appear in
22	// the sandbox, read-only, in GitHub's layout: <dir>/node24/bin/node.
23	GuestExternalsDir = "/home/runner/externals"
24	// ExternalUnavailableFile, in <GuestExternalsDir>/<name>, tells why a tool
25	// is missing on this runner. A directory that has it has no tool (its
26	// bin/node only prints the reason and fails).
27	ExternalUnavailableFile = "UNAVAILABLE"
28	// GuestScratch is where the per-job scratch disk (VM) or volume (container)
29	// is mounted; dockerd keeps its data root there.
30	GuestScratch = "/scratch"
31
32	// LabelJob marks every Docker object created for a job; reaping lists by it.
33	LabelJob = "dev.bnema.ermite-runner.job"
34
35	// Kernel command line keys of the VM (read from /proc/cmdline by init).
36	CmdlineSandbox = "ermite.sandbox" // "vm"
37	CmdlineConnect = "ermite.connect" // "vsock:1024"
38	CmdlineGateway = "ermite.gw"      // host side of the /30, also the DNS server
39	// CmdlineExternals=1: the externals disk is attached as the fourth drive.
40	CmdlineExternals = "ermite.externals"
41)
42
43// TmpMode is the mode of the job's /tmp, as on GitHub's runners: everyone may
44// write, only the owner may remove or rename (sticky). os.FileMode has its own
45// sticky flag: the octal 0o1777 would give a plain 0777, which programs that
46// check their temp directory refuse as replaceable.
47const TmpMode = 0o777 | os.ModeSticky