contract.go RawHistoryFolder
1// SPDX-License-Identifier: MIT
2
3package sandbox
4
5import (
6 "os"
7
8 "bnema.dev/ermite-runner/internal/cachesvc"
9)
10
11// The host/guest contract shared by the drivers and the guest side
12// (internal/guest). Changing a value here changes both sides at once because
13// the host always attaches its own executable to the sandbox.
14const (
15 // VsockPort is the vsock port the executor connects to on the host (CID 2).
16 VsockPort = 1024
17 // CacheVsockPort is the vsock port of the cache streams of a VM: each TCP
18 // connection the guest relay accepts on its loopback opens one connection to
19 // the host (CID 2) on this port. It is also the loopback port of the cache in
20 // the guest.
21 CacheVsockPort = cachesvc.DefaultPort
22 // CacheSocket is the cache stream socket of a container, next to the
23 // executor socket in ContainerRunDir; one connection per relayed TCP
24 // connection.
25 CacheSocket = "cache.sock"
26 // GuestExecDir and GuestExecName locate the runner executable inside the
27 // sandbox (read-only), in both modes.
28 GuestExecDir = "/opt/ermite"
29 GuestExecName = "ermite-runner"
30 // ContainerRunDir is the per-job directory bind-mounted into containers;
31 // ContainerSocket is the executor stream socket inside it.
32 ContainerRunDir = "/run/ermite"
33 ContainerSocket = "exec.sock"
34 // GuestExternalsDir is where the host's external tools (Node.js) appear in
35 // the sandbox, read-only, in GitHub's layout: <dir>/node24/bin/node.
36 GuestExternalsDir = "/home/runner/externals"
37 // ExternalUnavailableFile, in <GuestExternalsDir>/<name>, tells why a tool
38 // is missing on this runner. A directory that has it has no tool (its
39 // bin/node only prints the reason and fails).
40 ExternalUnavailableFile = "UNAVAILABLE"
41 // GuestScratch is where the per-job scratch disk (VM) or volume (container)
42 // is mounted; dockerd keeps its data root there.
43 GuestScratch = "/scratch"
44
45 // LabelJob marks every Docker object created for a job; reaping lists by it.
46 LabelJob = "dev.bnema.ermite-runner.job"
47
48 // Kernel command line keys of the VM (read from /proc/cmdline by init).
49 CmdlineSandbox = "ermite.sandbox" // "vm"
50 CmdlineConnect = "ermite.connect" // "vsock:1024"
51 CmdlineGateway = "ermite.gw" // host side of the /30, also the DNS server
52 // CmdlineExternals=1: the externals disk is attached as the fourth drive.
53 CmdlineExternals = "ermite.externals"
54)
55
56// TmpMode is the mode of the job's /tmp, as on GitHub's runners: everyone may
57// write, only the owner may remove or rename (sticky). os.FileMode has its own
58// sticky flag: the octal 0o1777 would give a plain 0777, which programs that
59// check their temp directory refuse as replaceable.
60const TmpMode = 0o777 | os.ModeSticky