feat(sandbox): UNIX domain socket bridge for supervisor RPC #19

New issue

Open

opened 2026-09-09 10:15:32 +00:00 by larandar · 0 comments

larandar commented

2026-09-09 10:15:32 +00:00

Owner

Proposal

Bridge supervisor RPC through a mounted UNIX socket in network-isolated sandboxes.

Design

Bind-mount the secured supervisor socket at /run/wf.sock and implement framed request/response RPC.

Tasks

Create and secure socket; add mount; implement framing and errors.

Gherkin Specification Delta

must.contracts.ting-workflows.deliverable-19

Scenario: Deliverable behavior

GIVEN the stated prerequisites and inputs
WHEN the feature is exercised
THEN --unshare-net, when the workflow requests RPC on /run/wf.sock, then supervisor answers without network.

## Proposal Bridge supervisor RPC through a mounted UNIX socket in network-isolated sandboxes. ## Design Bind-mount the secured supervisor socket at /run/wf.sock and implement framed request/response RPC. ## Tasks - Create and secure socket; add mount; implement framing and errors. ## Gherkin Specification Delta ### must.contracts.ting-workflows.deliverable-19 **Scenario: Deliverable behavior** - **GIVEN** the stated prerequisites and inputs - **WHEN** the feature is exercised - **THEN** --unshare-net, when the workflow requests RPC on /run/wf.sock, then supervisor answers without network.

larandar added a new dependency

2026-09-09 10:15:34 +00:00

#18 feat(sandbox): network containment and clearenv whitelist

larandar added a new dependency

2026-09-09 10:15:37 +00:00

#2 Session: ting-workflow-executor — embedded Nushell, bwrap sandboxing, and OWS DSL 1.0