quixos-toolchain/quixos-nix-helpers
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Admit checked restricted artifacts without individual code approvals

Browse Source
This commit is contained in:
Timothy J. Aveni
2026-10-07 21:43:44 -07:00
parent b5046ad680
commit b1397465ee
10 changed files with 209 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files
restricted-execution/service.mjs
+20 -9
View File
@@ -42,6 +42,8 @@ export class RestrictedEngineBudget {
})());
release.attach = resource.attach;
release.usage = resource.usage;
release.kill = resource.kill;
release.uid = resource.uid;
return release;
} catch (error) {
this.#leases.delete(lease);
@@ -82,6 +84,7 @@ export async function serveRestrictedRegistry(config, io = process) {
!absolute(config.worker) ||
!absolute(config.module) ||
(config.sandbox !== undefined && !absolute(config.sandbox)) ||
(config.sandboxIdentity !== undefined && typeof config.sandboxIdentity !== "boolean") ||
!/^[$A-Z_a-z][$\w]*$/.test(config.registryExport) ||
!Array.isArray(config.exports) ||
!config.exports.length ||
@@ -280,10 +283,13 @@ export async function serveRestrictedRegistry(config, io = process) {
if (index >= 0) idleEngines.splice(index, 1);
engine.current = null;
if (engine.child?.pid) {
try {
process.kill(-engine.child.pid, "SIGKILL");
} catch (error) {
if (error.code !== "ESRCH") throw error;
if (engine.release.kill) await engine.release.kill();
else {
try {
process.kill(-engine.child.pid, "SIGKILL");
} catch (error) {
if (error.code !== "ESRCH") throw error;
}
}
await engine.exited;
}
@@ -397,9 +403,13 @@ export async function serveRestrictedRegistry(config, io = process) {
const file = join(engine.directory, "config.capnp");
await writeFile(file, configuration);
if (!call.open) return;
if (config.sandboxIdentity && !Number.isSafeInteger(engine.release.uid))
throw fixedError("RESTRICTED_IDENTITY_UNAVAILABLE");
engine.child = spawn(
config.sandbox ?? config.workerd,
config.sandbox ? [engine.directory] : ["serve", "--experimental", file],
config.sandbox
? [engine.directory, ...(config.sandboxIdentity ? [String(engine.release.uid)] : [])]
: ["serve", "--experimental", file],
{
detached: true,
env: { TZ: "UTC", LANG: "C.UTF-8" },
@@ -414,16 +424,16 @@ export async function serveRestrictedRegistry(config, io = process) {
});
engine.child.stdin?.on("error", () => engine.current?.terminate("RESTRICTED_START_FAILED"));
call.child = engine.child;
await engine.release.attach?.(engine.child.pid);
if (config.sandbox && call.open) engine.child.stdin.end(Buffer.from([1]));
watchCPU(call);
let diagnostics = 0;
engine.child.stderr.on("data", (chunk) => {
if ((diagnostics += chunk.length) > 65536) {
if (engine.current?.open) engine.current.terminate("RESTRICTED_DIAGNOSTIC_LIMIT");
else void destroyEngine(engine).catch(fail);
}
} else config.diagnostics?.(chunk);
});
await engine.release.attach?.(engine.child.pid);
if (config.sandbox && call.open) engine.child.stdin.end(Buffer.from([1]));
watchCPU(call);
engine.child.once("error", () => engine.current?.terminate("RESTRICTED_START_FAILED"));
void engine.exited.then(() => {
if (engine.current?.open) engine.current.terminate("RESTRICTED_ENGINE_EXITED");
@@ -535,6 +545,7 @@ export async function serveRestrictedRegistry(config, io = process) {
await finish(call, fixedError("INVOCATION_ENDED"), reply);
metrics.completed++;
} catch (error) {
config.diagnostics?.(Buffer.from(`RESTRICTED_HOST_ERROR:${error.code ?? error.name}\n`));
if (call.open) {
const code = /^RESTRICTED_[A-Z_]+$/.test(error.code ?? "") ? error.code : "RESTRICTED_PACKAGE_FAILED";
await finish(call, error, { invocation: message.invocation, status: "failed", error: { code, message: code } });