Omar SobhandClaude Fable 5
a26939d7bc
- The compose server NEVER sees the raw Docker socket (plan risk #5): tecnativa/docker-socket-proxy on an isolated engine_net with exactly CONTAINERS/POST/EXEC/DELETE/VERSION allowed; server reaches it via DOCKER_HOST. DockerDriver honors DOCKER_HOST (connect_to). Proven by a REAL proxy test: full sandbox lifecycle works through the allowlist while /networks, /secrets, and /images all 403 — the blast-radius cap if the server is ever owned. (This also fixes compose deployments, where sandbox provisioning previously had no engine access at all.) - Gateway load test (plan P6): 40 concurrent SSE streams against one server — every run completes with the full §13 event vocabulary, every journal strictly monotonic, every resumeFrom=0 replay byte-equal to its live stream - release.yml: SBOMs (syft, spdx-json) for all four images shipped INSIDE the signed bundle; final verification now runs in a --network none container — proving the customer's verify path needs no internet, not just claiming it 159 Rust tests. Co-Authored-By: Claude Fable 5 <[email protected]>
33 lines
1.0 KiB
TOML
33 lines
1.0 KiB
TOML
[package]
|
|
name = "tc-sandbox"
|
|
version = "0.1.0"
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license.workspace = true
|
|
publish.workspace = true
|
|
|
|
[dependencies]
|
|
async-trait = "0.1"
|
|
bollard = "0.19"
|
|
futures = "0.3"
|
|
k8s-openapi = { version = "0.25", features = ["latest"], optional = true }
|
|
kube = { version = "1", features = ["client", "rustls-tls", "ws"], default-features = false, optional = true }
|
|
rustls = { version = "0.23", features = ["ring"], default-features = false, optional = true }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
tokio = { workspace = true }
|
|
|
|
[features]
|
|
# The Kubernetes driver (kube-rs is a heavy dependency tree; the Docker
|
|
# driver alone serves dev and the air-gapped target).
|
|
k8s = ["dep:kube", "dep:k8s-openapi", "dep:rustls"]
|
|
# Live kind-cluster tests for the K8s driver (dedicated CI job).
|
|
k8s-tests = ["k8s"]
|
|
|
|
[dev-dependencies]
|
|
reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
|
|
|
|
[lints]
|
|
workspace = true
|