Implement VM-scoped restricted registry transport

2026-10-07 04:04:32 -07:00
parent 1f7aa80130
commit 47fcb47d5c
10 changed files with 1051 additions and 5 deletions
@@ -96,6 +96,18 @@ let
      esbuild = "${pkgs.esbuild}/bin/esbuild";
      shell = "${pkgs.runtimeShell}";
      serviceAdapter = ./portable-service.mjs;
+      restricted =
+        if service.restricted or false then
+          let
+            executor = import ./restricted-execution { inherit pkgs core; };
+          in
+          {
+            runtime = "${executor.runtime}/bin/quixos-restricted-registry";
+            sdk = "${executor.sdk}/core.mjs";
+            limits = service.limits or { };
+          }
+        else
+          null;
    }
  );
  compiled =