Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.
| Merge the desktop app's runner: it starts with the app for the signed-in person, sandboxed by default and running nothing where no sandbox is available yet, registers through the site, keeps itself up to date, and says everywhere what it is doing, why it is not, and how to fix it. | 1 | //! The one place the app meets `g1t-runner sandbox`: the launcher that |
| 2 | //! makes a Linux VM of its own on this computer (Hyper-V or WSL on | |
| 3 | //! Windows, Apple's Virtualization framework on macOS, Sysbox or KVM on | |
| 4 | //! Linux) and runs the runner inside it, so jobs are containers inside the | |
| 5 | //! runner's sandbox and none of it reaches this computer | |
| 6 | //! (`nested-container` isolation). | |
| 7 | //! | |
| 8 | //! It is being built in crates/runner. Until it is released, `READY` is | |
| 9 | //! false: the Sandboxed backend uses the runner's image under Sysbox where | |
| 10 | //! this computer's Docker has it (container.rs), and says a sandbox isn't | |
| 11 | //! available everywhere else. The commands below are the expected shape | |
| 12 | //! (`sandbox up|down|update`, configured like `register-and-run`, from | |
| 13 | //! `G1T_RUNNER_*` in the environment); when the launcher lands, this file | |
| 14 | //! is the only one that changes. | |
| 15 | ||
| 16 | use std::path::Path; | |
| 17 | use std::process::{Command, Stdio}; | |
| 18 | ||
| 19 | use super::backend::quiet; | |
| 20 | ||
| 21 | /// Whether the released `g1t-runner` has its sandbox launcher. | |
| 22 | pub const READY: bool = false; | |
| 23 | ||
| 24 | /// The launcher's own folder under the app's runner folder: its VM and the | |
| 25 | /// runner's registration inside it are kept there. | |
| 26 | pub const FOLDER: &str = "sandbox"; | |
| 27 | ||
| 28 | fn sandbox(binary: &Path, action: &str, dir: &Path) -> Command { | |
| 29 | let mut command = quiet(binary); | |
| 30 | command.args(["sandbox", action, "--dir"]).arg(dir); | |
| 31 | command | |
| 32 | } | |
| 33 | ||
| 34 | /// Makes the sandbox if it is not there, starts it, and runs the runner | |
| 35 | /// inside it until `down`: a child whose output is the runner's log. | |
| 36 | pub fn up(binary: &Path, dir: &Path) -> Command { | |
| 37 | let mut command = sandbox(binary, "up", dir); | |
| 38 | command.stdout(Stdio::piped()).stderr(Stdio::piped()); | |
| 39 | command | |
| 40 | } | |
| 41 | ||
| 42 | /// Stops the runner and the sandbox around it, waiting for neither job nor VM to linger. | |
| 43 | pub fn down(binary: &Path, dir: &Path) { | |
| 44 | let _ = sandbox(binary, "down", dir).stdout(Stdio::null()).stderr(Stdio::null()).status(); | |
| 45 | } | |
| 46 | ||
| 47 | /// Brings the sandbox's image to the release of `binary`; true when it changed. | |
| 48 | pub fn update(binary: &Path, dir: &Path) -> bool { | |
| 49 | sandbox(binary, "update", dir).stdout(Stdio::null()).stderr(Stdio::null()).status().is_ok_and(|status| status.success()) | |
| 50 | } |
This file's history is long; its oldest lines are credited to the oldest commit read.