mirror of
https://github.com/anthropic-experimental/sandbox-runtime.git
synced 2026-05-07 06:01:25 +08:00
7f650392ee
* Bake BPF filter into apply-seccomp, build in CI
The unix-block BPF filter is now generated as a C header at build time
and compiled directly into apply-seccomp. The separate .bpf file is gone,
as is the TS machinery that found, loaded, and tracked it.
vendor/seccomp/build.ts compiles the BPF generator, runs it for both
x64 and arm64, writes the bytes into unix-block-bpf.h, then compiles
apply-seccomp with that header #included. An #if defined(__x86_64__) /
#elif defined(__aarch64__) block in the header picks the right filter
at compile time.
The built binaries are no longer committed. release.yml runs a matrix
job on both an x64 and an arm64 runner, each building apply-seccomp
for its own architecture, uploading the result as an artifact. The
publish job downloads both into vendor/seccomp/{x64,arm64}/ before
npm publish, keeping the tarball layout unchanged.
* Build seccomp binaries in docker-tests CI job
* Remove stale references to on-disk BPF filter file
The two fail-closed tests in pid-namespace-isolation now test execve
failure instead of filter-file validation, since apply-seccomp no longer
takes a filter argument. README still described .bpf files in
vendor/seccomp/.
* Bump version to 0.0.47
117 lines
2.7 KiB
JavaScript
117 lines
2.7 KiB
JavaScript
import globals from 'globals'
|
|
import pluginJs from '@eslint/js'
|
|
import tseslint from 'typescript-eslint'
|
|
import pluginNode from 'eslint-plugin-n'
|
|
import pluginImport from 'eslint-plugin-import'
|
|
import prettierRecommended from 'eslint-plugin-prettier/recommended'
|
|
|
|
export default [
|
|
{
|
|
ignores: ['node_modules/', 'dist/', '**/*.d.ts'],
|
|
},
|
|
{
|
|
files: ['**/*.{js,ts}'],
|
|
},
|
|
{ languageOptions: { globals: globals.node } },
|
|
pluginJs.configs.recommended,
|
|
...tseslint.configs.recommended,
|
|
{
|
|
languageOptions: {
|
|
parserOptions: {
|
|
projectService: {
|
|
allowDefaultProject: ['eslint.config.js', 'vendor/seccomp/build.ts'],
|
|
},
|
|
tsconfigRootDir: import.meta.dirname,
|
|
},
|
|
},
|
|
},
|
|
{
|
|
files: ['test/**/*.ts'],
|
|
languageOptions: {
|
|
parserOptions: {
|
|
project: './tsconfig.test.json',
|
|
projectService: false,
|
|
},
|
|
},
|
|
},
|
|
{
|
|
plugins: {
|
|
'eslint-plugin-n': pluginNode,
|
|
import: pluginImport,
|
|
},
|
|
rules: {
|
|
'@typescript-eslint/no-unused-vars': [
|
|
'error',
|
|
{
|
|
args: 'all',
|
|
argsIgnorePattern: '^_',
|
|
caughtErrors: 'all',
|
|
caughtErrorsIgnorePattern: '^_',
|
|
destructuredArrayIgnorePattern: '^_',
|
|
varsIgnorePattern: '^_',
|
|
ignoreRestSiblings: true,
|
|
},
|
|
],
|
|
'@typescript-eslint/switch-exhaustiveness-check': [
|
|
'error',
|
|
{
|
|
considerDefaultExhaustiveForUnions: true,
|
|
},
|
|
],
|
|
'@typescript-eslint/await-thenable': 'error',
|
|
'@typescript-eslint/no-floating-promises': [
|
|
'error',
|
|
{
|
|
ignoreVoid: true,
|
|
ignoreIIFE: true,
|
|
},
|
|
],
|
|
'@typescript-eslint/consistent-type-imports': [
|
|
'error',
|
|
{
|
|
prefer: 'type-imports',
|
|
fixStyle: 'inline-type-imports',
|
|
},
|
|
],
|
|
eqeqeq: ['error', 'always'],
|
|
'eslint-plugin-n/no-unsupported-features/es-builtins': [
|
|
'error',
|
|
{
|
|
version: '>=18.0.0',
|
|
ignores: [],
|
|
},
|
|
],
|
|
'eslint-plugin-n/no-unsupported-features/node-builtins': [
|
|
'error',
|
|
{
|
|
version: '>=18.0.0',
|
|
ignores: [],
|
|
},
|
|
],
|
|
'no-async-promise-executor': 'off',
|
|
'import/no-cycle': [
|
|
'warn',
|
|
{
|
|
maxDepth: 4,
|
|
ignoreExternal: true,
|
|
disableScc: true,
|
|
},
|
|
],
|
|
},
|
|
settings: {
|
|
'import/parsers': {
|
|
'@typescript-eslint/parser': ['.ts'],
|
|
},
|
|
'import/resolver': {
|
|
typescript: {
|
|
project: './tsconfig.json',
|
|
},
|
|
},
|
|
},
|
|
linterOptions: {
|
|
reportUnusedDisableDirectives: false,
|
|
},
|
|
},
|
|
prettierRecommended,
|
|
]
|