95 lines
2.3 KiB
TypeScript
95 lines
2.3 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
|
|
import { buildSandboxCreateArgs, type SandboxDockerConfig } from "./sandbox.js";
|
|
|
|
describe("buildSandboxCreateArgs", () => {
|
|
it("includes hardening and resource flags", () => {
|
|
const cfg: SandboxDockerConfig = {
|
|
image: "clawdbot-sandbox:bookworm-slim",
|
|
containerPrefix: "clawdbot-sbx-",
|
|
workdir: "/workspace",
|
|
readOnlyRoot: true,
|
|
tmpfs: ["/tmp"],
|
|
network: "none",
|
|
user: "1000:1000",
|
|
capDrop: ["ALL"],
|
|
env: { LANG: "C.UTF-8" },
|
|
pidsLimit: 256,
|
|
memory: "512m",
|
|
memorySwap: 1024,
|
|
cpus: 1.5,
|
|
ulimits: {
|
|
nofile: { soft: 1024, hard: 2048 },
|
|
nproc: 128,
|
|
core: "0",
|
|
},
|
|
seccompProfile: "/tmp/seccomp.json",
|
|
apparmorProfile: "clawdbot-sandbox",
|
|
dns: ["1.1.1.1"],
|
|
extraHosts: ["internal.service:10.0.0.5"],
|
|
};
|
|
|
|
const args = buildSandboxCreateArgs({
|
|
name: "clawdbot-sbx-test",
|
|
cfg,
|
|
scopeKey: "main",
|
|
createdAtMs: 1700000000000,
|
|
labels: { "clawdbot.sandboxBrowser": "1" },
|
|
});
|
|
|
|
expect(args).toEqual(
|
|
expect.arrayContaining([
|
|
"create",
|
|
"--name",
|
|
"clawdbot-sbx-test",
|
|
"--label",
|
|
"clawdbot.sandbox=1",
|
|
"--label",
|
|
"clawdbot.sessionKey=main",
|
|
"--label",
|
|
"clawdbot.createdAtMs=1700000000000",
|
|
"--label",
|
|
"clawdbot.sandboxBrowser=1",
|
|
"--read-only",
|
|
"--tmpfs",
|
|
"/tmp",
|
|
"--network",
|
|
"none",
|
|
"--user",
|
|
"1000:1000",
|
|
"--cap-drop",
|
|
"ALL",
|
|
"--security-opt",
|
|
"no-new-privileges",
|
|
"--security-opt",
|
|
"seccomp=/tmp/seccomp.json",
|
|
"--security-opt",
|
|
"apparmor=clawdbot-sandbox",
|
|
"--dns",
|
|
"1.1.1.1",
|
|
"--add-host",
|
|
"internal.service:10.0.0.5",
|
|
"--pids-limit",
|
|
"256",
|
|
"--memory",
|
|
"512m",
|
|
"--memory-swap",
|
|
"1024",
|
|
"--cpus",
|
|
"1.5",
|
|
]),
|
|
);
|
|
|
|
const ulimitValues: string[] = [];
|
|
for (let i = 0; i < args.length; i += 1) {
|
|
if (args[i] === "--ulimit") {
|
|
const value = args[i + 1];
|
|
if (value) ulimitValues.push(value);
|
|
}
|
|
}
|
|
expect(ulimitValues).toEqual(
|
|
expect.arrayContaining(["nofile=1024:2048", "nproc=128", "core=0"]),
|
|
);
|
|
});
|
|
});
|