surma/sausage
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

builder: enforce target, source sync, and timeout contracts

Browse Source
This commit is contained in:
surma
2026-11-07 12:32:45 +00:00
parent a27d579264
commit 2f18f0fa4c
4 changed files with 182 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
host/src/builder/README.md
+12 -3
View File
@@ -8,18 +8,27 @@ For `test` and `run`, arguments after `--` belong to the executable, not the hos
Other commands retain their `--` arguments, such as `fmt -- --check` and Clippy lint options.
The host finds the Cargo workspace above the requested directory and copies its sources through the shared VFS.
It excludes `target` and `.git`. Each workspace owns a source copy, target directory, registry, and kache cache.
It excludes `target` and `.git`.
Each workspace owns a source copy, target directory, registry, and kache cache.
These directories live under `<dir>/host/builds/`.
Cargo fetches dependencies with network access. The command then runs offline inside bubblewrap namespaces.
Only the source copy, target, and private kache cache permit writes.
The registry and Nix store remain read-only. HOME and the host network are absent.
The PID namespace removes compiler descendants and the private kache daemon after Cargo exits.
The builder copies changed and new source files back through the VFS.
It preserves other source files, including concurrent edits in the world.
It publishes WASI executables into the world's workspace target directory.
After `cargo clean`, it removes the published artifacts that Cargo removed from the native target.
Every target build links the shared cwd-init object, including its numeric exit-code interface.
The command deadline defaults to 30 minutes. A closed response cancels the native command and its process group.
Every target build uses `wasm32-wasip2` and links the shared cwd-init object, including its numeric exit-code interface.
The host rejects other build targets and `--target-dir` overrides.
The command deadline defaults to 30 minutes.
The host kills timed-out commands before it sends their timeout message.
A closed response cancels the native command and its process group.
The host retains at most 20 GiB of build directories and evicts the oldest workspace first.
The Nix wrapper supplies these tools on PATH: