sandbox

package
v0.35.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Dec 29, 2025 License: MIT Imports: 22 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var DefaultResourceLimits = &ResourceLimits{
	MaxCPUTime:     5 * time.Minute,
	MaxMemoryMB:    512,
	MaxFileSizeMB:  100,
	MaxProcesses:   50,
	MaxOpenFiles:   1024,
	MaxOutputBytes: 10 * 1024 * 1024,
}

DefaultResourceLimits 默认资源限制

Functions

This section is empty.

Types

type AuditEntry added in v0.31.0 

type AuditEntry struct {
	Timestamp   time.Time         `json:"timestamp"`
	Command     string            `json:"command"`
	WorkDir     string            `json:"work_dir"`
	ExitCode    int               `json:"exit_code"`
	Duration    time.Duration     `json:"duration"`
	Blocked     bool              `json:"blocked"`
	BlockReason string            `json:"block_reason,omitempty"`
	UserID      string            `json:"user_id,omitempty"`
	SessionID   string            `json:"session_id,omitempty"`
	Metadata    map[string]string `json:"metadata,omitempty"`
}

AuditEntry 审计日志条目

type CommandStats added in v0.31.0 

type CommandStats struct {
	TotalCalls   int64
	BlockedCalls int64
	TotalTime    time.Duration
	LastCall     time.Time
}

CommandStats 命令统计

type ExecOptions 

type ExecOptions struct {
	Timeout time.Duration
	WorkDir string
	Env     map[string]string
}

ExecOptions 命令执行选项

type ExecResult 

type ExecResult struct {
	Code   int
	Stdout string
	Stderr string
}

ExecResult 命令执行结果

type Factory 

type Factory struct {
}

Factory 沙箱工厂

func NewFactory 

func NewFactory() *Factory

NewFactory 创建沙箱工厂

func (*Factory) Create 

func (f *Factory) Create(config *types.SandboxConfig) (Sandbox, error)

Create 根据配置创建沙箱

type FileChangeEvent 

type FileChangeEvent struct {
	Path  string
	Mtime time.Time
}

FileChangeEvent 文件变更事件

type FileChangeListener 

type FileChangeListener func(event FileChangeEvent)

FileChangeListener 文件变更监听器

type FileInfo 

type FileInfo struct {
	Path    string
	Size    int64
	ModTime time.Time
	IsDir   bool
	Mode    int
}

FileInfo 文件信息

type GlobOptions 

type GlobOptions struct {
	CWD      string
	Ignore   []string
	Dot      bool
	Absolute bool
}

GlobOptions Glob选项

type LocalFS 

type LocalFS struct {
	// contains filtered or unexported fields
}

LocalFS 本地文件系统实现

func (*LocalFS) Glob 

func (lfs *LocalFS) Glob(ctx context.Context, pattern string, opts *GlobOptions) ([]string, error)

Glob 文件匹配

func (*LocalFS) IsInside 

func (lfs *LocalFS) IsInside(path string) bool

IsInside 检查路径是否在沙箱内 如果传入的是绝对路径，直接检查该路径是否在 workDir 或白名单内 如果传入的是相对路径，先解析为绝对路径再检查

func (*LocalFS) Read 

func (lfs *LocalFS) Read(ctx context.Context, path string) (string, error)

Read 读取文件内容

func (*LocalFS) Resolve 

func (lfs *LocalFS) Resolve(path string) string

Resolve 解析路径为绝对路径 注意：所有路径都会被解析为相对于 workDir 的路径，防止写入到工作目录外

func (*LocalFS) Stat 

func (lfs *LocalFS) Stat(ctx context.Context, path string) (FileInfo, error)

Stat 获取文件状态

func (*LocalFS) Temp 

func (lfs *LocalFS) Temp(name string) string

Temp 生成临时文件路径

func (*LocalFS) Write 

func (lfs *LocalFS) Write(ctx context.Context, path string, content string) error

Write 写入文件内容

type LocalSandbox 

type LocalSandbox struct {
	// contains filtered or unexported fields
}

LocalSandbox 本地沙箱实现

func NewLocalSandbox 

func NewLocalSandbox(config *LocalSandboxConfig) (*LocalSandbox, error)

NewLocalSandbox 创建本地沙箱

func (*LocalSandbox) AddBlockedCommand added in v0.31.0 

func (ls *LocalSandbox) AddBlockedCommand(cmd string)

AddBlockedCommand 添加阻止命令

func (*LocalSandbox) CheckNetworkAccess added in v0.31.0 

func (ls *LocalSandbox) CheckNetworkAccess(host string, port int) bool

CheckNetworkAccess 检查网络访问权限

func (*LocalSandbox) CheckUnixSocketAccess added in v0.31.0 

func (ls *LocalSandbox) CheckUnixSocketAccess(socketPath string) bool

CheckUnixSocketAccess 检查 Unix Socket 访问权限

func (*LocalSandbox) Dispose 

func (ls *LocalSandbox) Dispose() error

Dispose 释放资源

func (*LocalSandbox) Exec 

func (ls *LocalSandbox) Exec(ctx context.Context, cmd string, opts *ExecOptions) (*ExecResult, error)

Exec 执行命令

func (*LocalSandbox) FS 

func (ls *LocalSandbox) FS() SandboxFS

FS 返回文件系统接口

func (*LocalSandbox) GetAuditLog added in v0.31.0 

func (ls *LocalSandbox) GetAuditLog() []AuditEntry

GetAuditLog 获取审计日志

func (*LocalSandbox) GetCommandStats added in v0.31.0 

func (ls *LocalSandbox) GetCommandStats() map[string]*CommandStats

GetCommandStats 获取命令统计

func (*LocalSandbox) GetSecurityLevel added in v0.31.0 

func (ls *LocalSandbox) GetSecurityLevel() SecurityLevel

GetSecurityLevel 获取安全级别

func (*LocalSandbox) GetSettings added in v0.31.0 

func (ls *LocalSandbox) GetSettings() *types.SandboxSettings

GetSettings 获取沙箱安全设置

func (*LocalSandbox) IsEnabled added in v0.31.0 

func (ls *LocalSandbox) IsEnabled() bool

IsEnabled 检查沙箱是否启用

func (*LocalSandbox) Kind 

func (ls *LocalSandbox) Kind() string

Kind 返回沙箱类型

func (*LocalSandbox) RemoveBlockedCommand added in v0.31.0 

func (ls *LocalSandbox) RemoveBlockedCommand(cmd string)

RemoveBlockedCommand 移除阻止命令

func (*LocalSandbox) SetSecurityLevel added in v0.31.0 

func (ls *LocalSandbox) SetSecurityLevel(level SecurityLevel)

SetSecurityLevel 设置安全级别

func (*LocalSandbox) ShouldIgnoreViolation added in v0.31.0 

func (ls *LocalSandbox) ShouldIgnoreViolation(violationType, path string) bool

ShouldIgnoreViolation 检查是否应忽略违规

func (*LocalSandbox) Unwatch 

func (ls *LocalSandbox) Unwatch(watchID string) error

Unwatch 取消监听

func (*LocalSandbox) Watch 

func (ls *LocalSandbox) Watch(paths []string, listener FileChangeListener) (string, error)

Watch 监听文件变更

func (*LocalSandbox) WorkDir 

func (ls *LocalSandbox) WorkDir() string

WorkDir 返回工作目录

type LocalSandboxConfig 

type LocalSandboxConfig struct {
	WorkDir         string
	EnforceBoundary bool
	AllowPaths      []string
	WatchFiles      bool

	// Claude Agent SDK 风格的安全配置
	Settings *types.SandboxSettings

	// 增强安全配置
	SecurityLevel   SecurityLevel
	ResourceLimits  *ResourceLimits
	BlockedCommands []string
	MaxAuditEntries int
}

LocalSandboxConfig 本地沙箱配置

type MockFS 

type MockFS struct {
	// contains filtered or unexported fields
}

MockFS 模拟文件系统

func NewMockFS 

func NewMockFS() *MockFS

func (*MockFS) Glob 

func (mfs *MockFS) Glob(ctx context.Context, pattern string, opts *GlobOptions) ([]string, error)

func (*MockFS) IsInside 

func (mfs *MockFS) IsInside(path string) bool

func (*MockFS) Read 

func (mfs *MockFS) Read(ctx context.Context, path string) (string, error)

func (*MockFS) Resolve 

func (mfs *MockFS) Resolve(path string) string

func (*MockFS) Stat 

func (mfs *MockFS) Stat(ctx context.Context, path string) (FileInfo, error)

func (*MockFS) Temp 

func (mfs *MockFS) Temp(name string) string

func (*MockFS) Write 

func (mfs *MockFS) Write(ctx context.Context, path string, content string) error

type MockSandbox 

type MockSandbox struct {
	// contains filtered or unexported fields
}

MockSandbox 模拟沙箱(用于测试)

func NewMockSandbox 

func NewMockSandbox() *MockSandbox

NewMockSandbox 创建模拟沙箱

func (*MockSandbox) Dispose 

func (ms *MockSandbox) Dispose() error

func (*MockSandbox) Exec 

func (ms *MockSandbox) Exec(ctx context.Context, cmd string, opts *ExecOptions) (*ExecResult, error)

func (*MockSandbox) FS 

func (ms *MockSandbox) FS() SandboxFS

func (*MockSandbox) Kind 

func (ms *MockSandbox) Kind() string

func (*MockSandbox) Unwatch 

func (ms *MockSandbox) Unwatch(watchID string) error

func (*MockSandbox) Watch 

func (ms *MockSandbox) Watch(paths []string, listener FileChangeListener) (string, error)

func (*MockSandbox) WorkDir 

func (ms *MockSandbox) WorkDir() string

type RemoteClient 

type RemoteClient struct {
	// contains filtered or unexported fields
}

RemoteClient 远程沙箱客户端

func NewRemoteClient 

func NewRemoteClient(config *RemoteClientConfig) *RemoteClient

NewRemoteClient 创建远程客户端

func (*RemoteClient) Call 

func (rc *RemoteClient) Call(ctx context.Context, method, path string, body any) (*RemoteResponse, error)

Call 调用远程 API

type RemoteClientConfig 

type RemoteClientConfig struct {
	BaseURL   string
	APIKey    string
	APISecret string
	Timeout   time.Duration
	Headers   map[string]string
}

RemoteClientConfig 远程客户端配置

type RemoteFS 

type RemoteFS struct {
	// contains filtered or unexported fields
}

RemoteFS 远程文件系统

func (*RemoteFS) Glob 

func (rfs *RemoteFS) Glob(ctx context.Context, pattern string, opts *GlobOptions) ([]string, error)

Glob 匹配文件 (需要子类实现)

func (*RemoteFS) IsInside 

func (rfs *RemoteFS) IsInside(path string) bool

IsInside 检查路径是否在沙箱内

func (*RemoteFS) Read 

func (rfs *RemoteFS) Read(ctx context.Context, path string) (string, error)

Read 读取文件 (需要子类实现)

func (*RemoteFS) Resolve 

func (rfs *RemoteFS) Resolve(path string) string

Resolve 解析路径为绝对路径

func (*RemoteFS) Stat 

func (rfs *RemoteFS) Stat(ctx context.Context, path string) (FileInfo, error)

Stat 获取文件信息 (需要子类实现)

func (*RemoteFS) Temp 

func (rfs *RemoteFS) Temp(name string) string

Temp 生成临时文件路径

func (*RemoteFS) Write 

func (rfs *RemoteFS) Write(ctx context.Context, path string, content string) error

Write 写入文件 (需要子类实现)

type RemoteResponse 

type RemoteResponse struct {
	StatusCode int
	Body       []byte
	Headers    http.Header
}

RemoteResponse 远程响应

func (*RemoteResponse) JSON 

func (rr *RemoteResponse) JSON(v any) error

JSON 解析 JSON 响应

func (*RemoteResponse) String 

func (rr *RemoteResponse) String() string

String 返回字符串响应

type RemoteSandbox 

type RemoteSandbox struct {
	// contains filtered or unexported fields
}

RemoteSandbox 远程沙箱基础实现

func NewRemoteSandbox 

func NewRemoteSandbox(config *RemoteSandboxConfig) (*RemoteSandbox, error)

NewRemoteSandbox 创建远程沙箱

func (*RemoteSandbox) Dispose 

func (rs *RemoteSandbox) Dispose() error

Dispose 清理资源

func (*RemoteSandbox) Exec 

func (rs *RemoteSandbox) Exec(ctx context.Context, cmd string, opts *ExecOptions) (*ExecResult, error)

Exec 执行命令 (需要子类实现具体的 API 调用)

func (*RemoteSandbox) FS 

func (rs *RemoteSandbox) FS() SandboxFS

FS 返回文件系统接口

func (*RemoteSandbox) Kind 

func (rs *RemoteSandbox) Kind() string

Kind 返回沙箱类型

func (*RemoteSandbox) SessionID 

func (rs *RemoteSandbox) SessionID() string

SessionID 返回会话 ID

func (*RemoteSandbox) SetSessionID 

func (rs *RemoteSandbox) SetSessionID(id string)

SetSessionID 设置会话 ID

func (*RemoteSandbox) Unwatch 

func (rs *RemoteSandbox) Unwatch(watchID string) error

Unwatch 取消监听 (远程沙箱通常不支持)

func (*RemoteSandbox) Watch 

func (rs *RemoteSandbox) Watch(paths []string, listener FileChangeListener) (string, error)

Watch 监听文件变化 (远程沙箱通常不支持)

func (*RemoteSandbox) WorkDir 

func (rs *RemoteSandbox) WorkDir() string

WorkDir 返回工作目录

type RemoteSandboxConfig 

type RemoteSandboxConfig struct {
	BaseURL     string
	APIKey      string
	APISecret   string
	WorkDir     string
	Image       string            // 沙箱镜像
	Region      string            // 区域
	Timeout     time.Duration     // 超时时间
	Environment map[string]string // 环境变量
	Properties  map[string]any
}

RemoteSandboxConfig 远程沙箱配置

type ResourceLimits added in v0.31.0 

type ResourceLimits struct {
	MaxCPUTime     time.Duration // 最大 CPU 时间
	MaxMemoryMB    int           // 最大内存 (MB)
	MaxFileSizeMB  int           // 最大文件大小 (MB)
	MaxProcesses   int           // 最大进程数
	MaxOpenFiles   int           // 最大打开文件数
	MaxOutputBytes int           // 最大输出字节数
}

ResourceLimits 资源限制配置

type Sandbox 

type Sandbox interface {
	// Kind 返回沙箱类型
	Kind() string

	// WorkDir 返回工作目录
	WorkDir() string

	// FS 返回文件系统接口
	FS() SandboxFS

	// Exec 执行命令
	Exec(ctx context.Context, cmd string, opts *ExecOptions) (*ExecResult, error)

	// Watch 监听文件变更
	Watch(paths []string, listener FileChangeListener) (watchID string, err error)

	// Unwatch 取消监听
	Unwatch(watchID string) error

	// Dispose 释放资源
	Dispose() error
}

Sandbox 沙箱接口

type SandboxFS 

type SandboxFS interface {
	// Resolve 解析路径为绝对路径
	Resolve(path string) string

	// IsInside 检查路径是否在沙箱内
	IsInside(path string) bool

	// Read 读取文件内容
	Read(ctx context.Context, path string) (string, error)

	// Write 写入文件内容
	Write(ctx context.Context, path string, content string) error

	// Temp 生成临时文件路径
	Temp(name string) string

	// Stat 获取文件状态
	Stat(ctx context.Context, path string) (FileInfo, error)

	// Glob 文件匹配
	Glob(ctx context.Context, pattern string, opts *GlobOptions) ([]string, error)
}

SandboxFS 沙箱文件系统接口

type SecurityLevel added in v0.31.0 

type SecurityLevel int

SecurityLevel 安全级别 

const (
	// SecurityLevelNone 无安全限制
	SecurityLevelNone SecurityLevel = iota
	// SecurityLevelBasic 基础安全（危险命令检测）
	SecurityLevelBasic
	// SecurityLevelStrict 严格安全（路径限制+资源限制）
	SecurityLevelStrict
	// SecurityLevelParanoid 偏执安全（最严格）
	SecurityLevelParanoid
)

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.