TDvorak/Primora
1
0 Fork 0
mirror of https://github.com/Dvorinka/Primora.git synced 2026-10-28 07:41:23 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: Sandboxed function execution via FUNCTIONS_DRIVER=docker

Browse Source 
Each invoke runs in an ephemeral locked-down container — no network,
read-only rootfs, 128MiB/0.5CPU/64-pid caps, non-root, cap-drop ALL.
Source travels as base64 in the container env and materializes in the
tmpfs, so no bind mount is needed (Docker Desktop / remote daemons work).
Timeout force-removes the named container.

exec driver stays the default; the trust-model docs now describe both.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This commit is contained in:
Tomas DvorakandDevin committed 2026-09-24 20:45:33 +02:00
1 parent edef002beb
commit 9ae1c22af0
8 files changed
+246 -9
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

apps/backend/internal/app/app.go
+7 -1
View File
@@ -113,7 +113,13 @@ func Bootstrap(ctx context.Context) (*App, error) {
if err != nil {
return nil, fmt.Errorf("encryption key: %w", err)
}
platform := services.NewPlatformService(repo, store, services.NewMailer(cfg), os.Getenv("VITE_APP_URL"), dbxClient, encryptor, logger, services.NewExecRunner(cfg.FunctionsRuntime, cfg.FunctionsTimeout, cfg.FunctionsMaxBytes))
var fnRunner services.FunctionRunner
if cfg.FunctionsDriver == "docker" {
fnRunner = services.NewDockerRunner(cfg.FunctionsTimeout, cfg.FunctionsMaxBytes)
} else {
fnRunner = services.NewExecRunner(cfg.FunctionsRuntime, cfg.FunctionsTimeout, cfg.FunctionsMaxBytes)
}
platform := services.NewPlatformService(repo, store, services.NewMailer(cfg), os.Getenv("VITE_APP_URL"), dbxClient, encryptor, logger, fnRunner)
settings := services.NewSettingsService(repo, encryptor)
if cfg.Env == "production" {