| 1 | //! The one place the app meets `g1t-runner sandbox`: the launcher that |
| 2 | //! makes a Linux VM of its own on this computer (Hyper-V or WSL on |
| 3 | //! Windows, Apple's Virtualization framework on macOS, Sysbox or KVM on |
| 4 | //! Linux) and runs the runner inside it, so jobs are containers inside the |
| 5 | //! runner's sandbox and none of it reaches this computer |
| 6 | //! (`nested-container` isolation). |
| 7 | //! |
| 8 | //! It is being built in crates/runner. Until it is released, `READY` is |
| 9 | //! false: the Sandboxed backend uses the runner's image under Sysbox where |
| 10 | //! this computer's Docker has it (container.rs), and says a sandbox isn't |
| 11 | //! available everywhere else. The commands below are the expected shape |
| 12 | //! (`sandbox up|down|update`, configured like `register-and-run`, from |
| 13 | //! `G1T_RUNNER_*` in the environment); when the launcher lands, this file |
| 14 | //! is the only one that changes. |
| 15 | |
| 16 | use std::path::Path; |
| 17 | use std::process::{Command, Stdio}; |
| 18 | |
| 19 | use super::backend::quiet; |
| 20 | |
| 21 | /// Whether the released `g1t-runner` has its sandbox launcher. |
| 22 | pub const READY: bool = false; |
| 23 | |
| 24 | /// The launcher's own folder under the app's runner folder: its VM and the |
| 25 | /// runner's registration inside it are kept there. |
| 26 | pub const FOLDER: &str = "sandbox"; |
| 27 | |
| 28 | fn sandbox(binary: &Path, action: &str, dir: &Path) -> Command { |
| 29 | let mut command = quiet(binary); |
| 30 | command.args(["sandbox", action, "--dir"]).arg(dir); |
| 31 | command |
| 32 | } |
| 33 | |
| 34 | /// Makes the sandbox if it is not there, starts it, and runs the runner |
| 35 | /// inside it until `down`: a child whose output is the runner's log. |
| 36 | pub fn up(binary: &Path, dir: &Path) -> Command { |
| 37 | let mut command = sandbox(binary, "up", dir); |
| 38 | command.stdout(Stdio::piped()).stderr(Stdio::piped()); |
| 39 | command |
| 40 | } |
| 41 | |
| 42 | /// Stops the runner and the sandbox around it, waiting for neither job nor VM to linger. |
| 43 | pub fn down(binary: &Path, dir: &Path) { |
| 44 | let _ = sandbox(binary, "down", dir).stdout(Stdio::null()).stderr(Stdio::null()).status(); |
| 45 | } |
| 46 | |
| 47 | /// Brings the sandbox's image to the release of `binary`; true when it changed. |
| 48 | pub fn update(binary: &Path, dir: &Path) -> bool { |
| 49 | sandbox(binary, "update", dir).stdout(Stdio::null()).stderr(Stdio::null()).status().is_ok_and(|status| status.success()) |
| 50 | } |