feat: Sandboxed function execution via FUNCTIONS_DRIVER=docker

Each invoke runs in an ephemeral locked-down container — no network,
read-only rootfs, 128MiB/0.5CPU/64-pid caps, non-root, cap-drop ALL.
Source travels as base64 in the container env and materializes in the
tmpfs, so no bind mount is needed (Docker Desktop / remote daemons work).
Timeout force-removes the named container.

exec driver stays the default; the trust-model docs now describe both.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/internal/app/app.go

@@ -113,7 +113,13 @@ func Bootstrap(ctx context.Context) (*App, error) {
 	if err != nil {
 		return nil, fmt.Errorf("encryption key: %w", err)
 	}
-	platform := services.NewPlatformService(repo, store, services.NewMailer(cfg), os.Getenv("VITE_APP_URL"), dbxClient, encryptor, logger, services.NewExecRunner(cfg.FunctionsRuntime, cfg.FunctionsTimeout, cfg.FunctionsMaxBytes))
+	var fnRunner services.FunctionRunner
+	if cfg.FunctionsDriver == "docker" {
+		fnRunner = services.NewDockerRunner(cfg.FunctionsTimeout, cfg.FunctionsMaxBytes)
+	} else {
+		fnRunner = services.NewExecRunner(cfg.FunctionsRuntime, cfg.FunctionsTimeout, cfg.FunctionsMaxBytes)
+	}
+	platform := services.NewPlatformService(repo, store, services.NewMailer(cfg), os.Getenv("VITE_APP_URL"), dbxClient, encryptor, logger, fnRunner)
 	settings := services.NewSettingsService(repo, encryptor)
 
 	if cfg.Env == "production" {

apps/backend/internal/config/config.go

@@ -48,8 +48,11 @@ type Config struct {
 	S3Prefix         string
 	S3PathStyle      bool
 
-	// Functions runtime: binary name/path ("auto" resolves per-function
-	// runtime from PATH — "bun" or "deno"), timeout and output cap.
+	// Functions runtime: driver "exec" (runtime binary on the backend host)
+	// or "docker" (ephemeral locked-down container), binary name/path for
+	// exec ("auto" resolves per-function runtime from PATH), timeout and
+	// output cap.
+	FunctionsDriver   string
 	FunctionsRuntime  string
 	FunctionsTimeout  time.Duration
 	FunctionsMaxBytes int64
@@ -89,6 +92,7 @@ func Load() (Config, error) {
 		S3SecretAccessKey:     os.Getenv("S3_SECRET_ACCESS_KEY"),
 		S3PublicEndpoint:      os.Getenv("S3_PUBLIC_ENDPOINT"),
 		S3Prefix:              os.Getenv("S3_PREFIX"),
+		FunctionsDriver:       getenv("FUNCTIONS_DRIVER", "exec"),
 		FunctionsRuntime:      getenv("FUNCTIONS_RUNTIME", "auto"),
 		FunctionsMaxBytes:     65536,
 	}
@@ -135,6 +139,12 @@ func Load() (Config, error) {
 	}
 	cfg.FunctionsTimeout = time.Duration(fnTimeout) * time.Second
 
+	switch cfg.FunctionsDriver {
+	case "exec", "docker":
+	default:
+		return Config{}, fmt.Errorf("FUNCTIONS_DRIVER %q must be exec or docker", cfg.FunctionsDriver)
+	}
+
 	var missing []string
 	if cfg.DatabaseURL == "" {
 		missing = append(missing, "DATABASE_URL")

apps/backend/internal/services/function_docker.go

@@ -0,0 +1,137 @@
+package services
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"os/exec"
+	"strings"
+	"time"
+)
+
+// dockerRunner executes functions in an ephemeral, locked-down container:
+// no network, read-only rootfs, memory/CPU/pid caps, non-root, all
+// capabilities dropped. The source is passed through the environment as
+// base64 and materialized inside the container's tmpfs — no bind mount,
+// so this works on Docker Desktop (VM daemon) and remote daemons where
+// host paths aren't shared. The payload arrives on stdin — same contract
+// as execRunner, but user code no longer inherits backend privileges.
+// Requires the Docker socket (compose: mount /var/run/docker.sock) — the
+// documented trade-off: socket access is root-equivalent on the host, so
+// this driver isolates function code, not operators.
+type dockerRunner struct {
+	timeout   time.Duration
+	maxOutput int64
+	images    map[string]string // runtime -> image ref
+}
+
+// maxFnSourceBytes caps function source for the docker driver — the source
+// travels in the container spec (env), which kernels limit to ~2 MB total;
+// 256 KiB keeps argv+env comfortably inside it.
+const maxFnSourceBytes = 256 << 10
+
+func NewDockerRunner(timeout time.Duration, maxOutput int64) *dockerRunner {
+	return &dockerRunner{
+		timeout:   timeout,
+		maxOutput: maxOutput,
+		images: map[string]string{
+			"bun":  "oven/bun:1.3.14",
+			"deno": "denoland/deno:2.5.6",
+		},
+	}
+}
+
+func (r *dockerRunner) Run(ctx context.Context, runtime, code string, payload json.RawMessage) FunctionResult {
+	image, ok := r.images[runtime]
+	if !ok {
+		return FunctionResult{Status: "error", Stderr: "no container image configured for runtime " + runtime}
+	}
+	if len(code) > maxFnSourceBytes {
+		return FunctionResult{Status: "error", Stderr: fmt.Sprintf("function source exceeds %d KiB docker-driver limit", maxFnSourceBytes>>10)}
+	}
+	if _, err := exec.LookPath("docker"); err != nil {
+		return FunctionResult{Status: "error", Stderr: "FUNCTIONS_DRIVER=docker but docker CLI not found"}
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, r.timeout)
+	defer cancel()
+
+	// Named container so a timed-out client doesn't orphan a running fn.
+	var suffix [4]byte
+	_, _ = rand.Read(suffix[:])
+	name := "primora-fn-" + hex.EncodeToString(suffix[:])
+
+	// Write source inside the container, then run it. base64 keeps the
+	// code inert data — it is decoded by the shell, never interpreted.
+	entrypoint := fmt.Sprintf(
+		`echo "$PRIMORA_CODE" | base64 -d > /tmp/fn.ts && %s /tmp/fn.ts`,
+		map[bool]string{true: "deno run --no-prompt", false: "bun run"}[runtime == "deno"],
+	)
+
+	args := []string{
+		"run", "--rm", "-i", "--name", name,
+		"--network", "none",
+		"--memory", "128m", "--memory-swap", "128m",
+		"--cpus", "0.5",
+		"--pids-limit", "64",
+		"--read-only",
+		"--tmpfs", "/tmp:rw,noexec,nosuid,size=16m",
+		"--cap-drop", "ALL",
+		"--security-opt", "no-new-privileges",
+		"--user", "65534:65534",
+		"-e", "PRIMORA_CODE=" + base64.StdEncoding.EncodeToString([]byte(code)),
+		"-e", "PRIMORA_PAYLOAD=" + string(payload),
+		"-e", "PRIMORA_FUNCTION_RUNTIME=" + runtime,
+		"--entrypoint", "sh",
+		image, "-c", entrypoint,
+	}
+
+	cmd := exec.CommandContext(ctx, "docker", args...)
+	cmd.Stdin = bytes.NewReader(payload)
+
+	var stdout, stderr bytes.Buffer
+	cmd.Stdout = &limitedWriter{w: &stdout, max: r.maxOutput}
+	cmd.Stderr = &limitedWriter{w: &stderr, max: r.maxOutput}
+
+	// ctx cancel kills the docker CLI but the daemon keeps the container
+	// running — force-remove it so a stuck function can't linger.
+	done := make(chan struct{})
+	go func() {
+		select {
+		case <-ctx.Done():
+			_ = exec.Command("docker", "rm", "-f", name).Run()
+		case <-done:
+		}
+	}()
+	defer close(done)
+
+	start := time.Now()
+	runErr := cmd.Run()
+	duration := time.Since(start).Milliseconds()
+
+	res := FunctionResult{
+		Status:     "success",
+		Stdout:     stdout.String(),
+		Stderr:     stderr.String(),
+		DurationMs: duration,
+	}
+	if ctx.Err() == context.DeadlineExceeded {
+		res.Status = "timeout"
+		res.Stderr = strings.TrimSpace(res.Stderr + "\nexecution timed out")
+		return res
+	}
+	if runErr != nil {
+		res.Status = "error"
+		if exitErr, ok := runErr.(*exec.ExitError); ok {
+			code := int32(exitErr.ExitCode())
+			res.ExitCode = &code
+		} else {
+			res.Stderr = strings.TrimSpace(fmt.Sprintf("%v\n%s", runErr, res.Stderr))
+		}
+	}
+	return res
+}

apps/backend/internal/services/function_docker_test.go

@@ -0,0 +1,59 @@
+package services
+
+import (
+	"context"
+	"encoding/json"
+	"os/exec"
+	"strings"
+	"testing"
+	"time"
+)
+
+func dockerAvailable(t *testing.T) {
+	t.Helper()
+	if _, err := exec.LookPath("docker"); err != nil {
+		t.Skip("docker CLI not installed")
+	}
+	if err := exec.Command("docker", "info").Run(); err != nil {
+		t.Skip("docker daemon not reachable")
+	}
+	// The test pulls the runtime image on first run.
+	if err := exec.Command("docker", "image", "inspect", "oven/bun:1.3.14").Run(); err != nil {
+		t.Skip("oven/bun:1.3.14 image not pulled")
+	}
+}
+
+func TestDockerRunnerRunsCode(t *testing.T) {
+	dockerAvailable(t)
+	r := NewDockerRunner(30*time.Second, 65536)
+	res := r.Run(context.Background(), "bun",
+		`const p = JSON.parse(await new Response(Bun.stdin.stream()).text()); console.log("hi " + p.name);`,
+		json.RawMessage(`{"name":"sandbox"}`))
+	if res.Status != "success" {
+		t.Fatalf("status = %q stderr = %q", res.Status, res.Stderr)
+	}
+	if !strings.Contains(res.Stdout, "hi sandbox") {
+		t.Fatalf("stdout = %q", res.Stdout)
+	}
+}
+
+func TestDockerRunnerIsolatesNetwork(t *testing.T) {
+	dockerAvailable(t)
+	r := NewDockerRunner(30*time.Second, 65536)
+	// --network none: even a DNS/connect attempt must fail inside.
+	res := r.Run(context.Background(), "bun",
+		`try { await fetch("http://169.254.169.254/"); console.log("NET-OPEN") } catch { console.log("NET-CLOSED") }`,
+		json.RawMessage(`{}`))
+	if !strings.Contains(res.Stdout, "NET-CLOSED") {
+		t.Fatalf("network should be unreachable, stdout = %q stderr = %q status = %q", res.Stdout, res.Stderr, res.Status)
+	}
+}
+
+func TestDockerRunnerTimesOut(t *testing.T) {
+	dockerAvailable(t)
+	r := NewDockerRunner(2*time.Second, 65536)
+	res := r.Run(context.Background(), "bun", `while (true) {}`, json.RawMessage(`{}`))
+	if res.Status != "timeout" {
+		t.Fatalf("status = %q", res.Status)
+	}
+}