Rename firecracker-manager.js to gvisor-manager.js

firecracker-manager.js

@@ -1,240 +0,0 @@
-const { spawn, exec } = require('child_process');
-const fs = require('fs').promises;
-const path = require('path');
-const { v4: uuidv4 } = require('uuid');
-
-class FirecrackerManager {
-  constructor() {
-    this.vms = new Map();
-    this.baseKernel = '/firecracker/vmlinux.bin';
-    this.baseRootfs = '/firecracker/rootfs.ext4';
-    this.vmPath = '/tmp/firecracker-vms';
-  }
-
-  async initialize() {
-    // Create VM directory
-    await fs.mkdir(this.vmPath, { recursive: true });
-    
-    // Setup KVM access
-    try {
-      await this.execCommand('chmod 666 /dev/kvm');
-      console.log('✅ KVM access configured');
-    } catch (e) {
-      console.error('⚠️  KVM setup failed:', e.message);
-    }
-  }
-
-  execCommand(cmd) {
-    return new Promise((resolve, reject) => {
-      exec(cmd, (error, stdout, stderr) => {
-        if (error) reject(error);
-        else resolve(stdout);
-      });
-    });
-  }
-
-  async createVM(sandboxId) {
-    const vmId = uuidv4();
-    const vmDir = path.join(this.vmPath, vmId);
-    const socketPath = path.join(vmDir, 'firecracker.socket');
-    const rootfsPath = path.join(vmDir, 'rootfs.ext4');
-    
-    // Create VM directory
-    await fs.mkdir(vmDir, { recursive: true });
-    
-    // Copy rootfs for this VM (isolated filesystem)
-    await fs.copyFile(this.baseRootfs, rootfsPath);
-    
-    // Create VM configuration
-    const config = {
-      'boot-source': {
-        'kernel_image_path': this.baseKernel,
-        'boot_args': 'ro console=ttyS0 noapic reboot=k panic=1 pci=off'
-      },
-      'drives': [{
-        'drive_id': 'rootfs',
-        'path_on_host': rootfsPath,
-        'is_root_device': true,
-        'is_read_only': false
-      }],
-      'machine-config': {
-        'vcpu_count': 2,
-        'mem_size_mib': 512,
-        'ht_enabled': false
-      },
-      'network-interfaces': [{
-        'iface_id': 'eth0',
-        'guest_mac': this.generateMAC(),
-        'host_dev_name': `tap-${vmId.substr(0, 8)}`
-      }]
-    };
-    
-    const configPath = path.join(vmDir, 'config.json');
-    await fs.writeFile(configPath, JSON.stringify(config, null, 2));
-    
-    // Setup network interface
-    await this.setupNetworking(config['network-interfaces'][0].host_dev_name);
-    
-    // Start Firecracker process
-    const fcProcess = spawn('firecracker', [
-      '--api-sock', socketPath,
-      '--config-file', configPath
-    ], {
-      detached: true,
-      stdio: ['ignore', 'pipe', 'pipe']
-    });
-    
-    fcProcess.unref();
-    
-    const vmInfo = {
-      vmId,
-      sandboxId,
-      socketPath,
-      configPath,
-      rootfsPath,
-      vmDir,
-      process: fcProcess,
-      createdAt: Date.now(),
-      status: 'starting'
-    };
-    
-    this.vms.set(sandboxId, vmInfo);
-    
-    // Wait for VM to boot
-    await this.waitForBoot(socketPath);
-    vmInfo.status = 'running';
-    
-    console.log(`✅ Firecracker VM created: ${vmId} for sandbox ${sandboxId}`);
-    return vmInfo;
-  }
-
-  async setupNetworking(tapName) {
-    try {
-      // Create TAP device
-      await this.execCommand(`ip tuntap add ${tapName} mode tap`);
-      await this.execCommand(`ip addr add 172.16.0.1/24 dev ${tapName}`);
-      await this.execCommand(`ip link set ${tapName} up`);
-      
-      // Enable IP forwarding
-      await this.execCommand('echo 1 > /proc/sys/net/ipv4/ip_forward');
-      
-      // Setup NAT
-      await this.execCommand(`iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE`);
-      await this.execCommand(`iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT`);
-      await this.execCommand(`iptables -A FORWARD -i ${tapName} -o eth0 -j ACCEPT`);
-      
-      console.log(`✅ Network configured: ${tapName}`);
-    } catch (e) {
-      console.error('⚠️  Network setup error:', e.message);
-    }
-  }
-
-  generateMAC() {
-    return '06:00:' + 
-      [...Array(4)].map(() => 
-        Math.floor(Math.random() * 256).toString(16).padStart(2, '0')
-      ).join(':');
-  }
-
-  async waitForBoot(socketPath, maxAttempts = 30) {
-    for (let i = 0; i < maxAttempts; i++) {
-      try {
-        const exists = await fs.access(socketPath).then(() => true).catch(() => false);
-        if (exists) {
-          await new Promise(resolve => setTimeout(resolve, 500));
-          return true;
-        }
-      } catch (e) {}
-      await new Promise(resolve => setTimeout(resolve, 1000));
-    }
-    throw new Error('VM failed to boot');
-  }
-
-  async executeInVM(sandboxId, command) {
-    const vm = this.vms.get(sandboxId);
-    if (!vm) throw new Error('VM not found');
-    
-    // Execute command via Firecracker API
-    const result = await this.execCommand(`
-      curl --unix-socket ${vm.socketPath} -i \
-      -X PUT 'http://localhost/actions' \
-      -H 'Content-Type: application/json' \
-      -d '{"action_type": "SendCtrlAltDel"}'
-    `);
-    
-    return result;
-  }
-
-  async writeFile(sandboxId, filePath, content) {
-    const vm = this.vms.get(sandboxId);
-    if (!vm) throw new Error('VM not found');
-    
-    // Mount rootfs and write file
-    const mountPoint = path.join(vm.vmDir, 'mount');
-    await fs.mkdir(mountPoint, { recursive: true });
-    
-    try {
-      // Pause VM
-      await this.execCommand(`
-        curl --unix-socket ${vm.socketPath} -i \
-        -X PATCH 'http://localhost/vm' \
-        -H 'Content-Type: application/json' \
-        -d '{"state": "Paused"}'
-      `);
-      
-      // Mount filesystem
-      await this.execCommand(`mount -o loop ${vm.rootfsPath} ${mountPoint}`);
-      
-      // Write file
-      const fullPath = path.join(mountPoint, filePath);
-      await fs.mkdir(path.dirname(fullPath), { recursive: true });
-      await fs.writeFile(fullPath, content);
-      
-      // Unmount
-      await this.execCommand(`umount ${mountPoint}`);
-      
-      // Resume VM
-      await this.execCommand(`
-        curl --unix-socket ${vm.socketPath} -i \
-        -X PATCH 'http://localhost/vm' \
-        -H 'Content-Type: application/json' \
-        -d '{"state": "Resumed"}'
-      `);
-      
-      console.log(`✅ File written to VM: ${filePath}`);
-    } catch (e) {
-      console.error('❌ File write error:', e.message);
-      throw e;
-    }
-  }
-
-  async destroyVM(sandboxId) {
-    const vm = this.vms.get(sandboxId);
-    if (!vm) return;
-    
-    console.log(`🧹 Destroying VM: ${vm.vmId}`);
-    
-    try {
-      // Stop VM
-      vm.process.kill('SIGTERM');
-      
-      // Cleanup network
-      const tapName = `tap-${vm.vmId.substr(0, 8)}`;
-      await this.execCommand(`ip link delete ${tapName}`).catch(() => {});
-      
-      // Remove VM directory
-      await fs.rm(vm.vmDir, { recursive: true, force: true });
-      
-      this.vms.delete(sandboxId);
-      console.log(`✅ VM destroyed: ${vm.vmId}`);
-    } catch (e) {
-      console.error('⚠️  VM cleanup error:', e.message);
-    }
-  }
-
-  getVM(sandboxId) {
-    return this.vms.get(sandboxId);
-  }
-}
-
-module.exports = FirecrackerManager;

gvisor-manager.js

@@ -0,0 +1,217 @@
+const { Docker } = require('dockerode');
+const { spawn, exec } = require('child_process');
+const fs = require('fs').promises;
+const path = require('path');
+
+class GVisorSandboxManager {
+  constructor() {
+    this.docker = new Docker({ socketPath: '/var/run/docker.sock' });
+    this.sandboxes = new Map();
+  }
+
+  async initialize() {
+    try {
+      // Start Docker daemon
+      this.dockerProcess = spawn('dockerd', [
+        '--host=unix:///var/run/docker.sock',
+        '--config-file=/etc/docker/daemon.json'
+      ], {
+        detached: true,
+        stdio: 'ignore'
+      });
+      
+      this.dockerProcess.unref();
+      
+      // Wait for Docker to be ready
+      await this.waitForDocker();
+      console.log('✅ Docker daemon started with gVisor runtime');
+      
+      // Pull base image
+      await this.pullImage('node:18-alpine');
+      console.log('✅ Base image ready');
+      
+    } catch (e) {
+      console.error('⚠️ Docker initialization error:', e.message);
+    }
+  }
+
+  async waitForDocker(maxAttempts = 30) {
+    for (let i = 0; i < maxAttempts; i++) {
+      try {
+        await this.docker.ping();
+        return true;
+      } catch (e) {
+        await new Promise(resolve => setTimeout(resolve, 1000));
+      }
+    }
+    throw new Error('Docker daemon failed to start');
+  }
+
+  async pullImage(image) {
+    return new Promise((resolve, reject) => {
+      this.docker.pull(image, (err, stream) => {
+        if (err) return reject(err);
+        
+        this.docker.modem.followProgress(stream, (err, output) => {
+          if (err) reject(err);
+          else resolve(output);
+        });
+      });
+    });
+  }
+
+  async createSandbox(sandboxId) {
+    const containerName = `sandbox-${sandboxId}`;
+    
+    // Create container with gVisor runtime
+    const container = await this.docker.createContainer({
+      name: containerName,
+      Image: 'node:18-alpine',
+      
+      // Use gVisor runtime
+      HostConfig: {
+        Runtime: 'runsc',
+        
+        // Resource limits
+        Memory: 512 * 1024 * 1024,        // 512MB
+        MemorySwap: 512 * 1024 * 1024,
+        CpuQuota: 50000,
+        CpuPeriod: 100000,
+        PidsLimit: 100,
+        
+        // Network isolation (optional)
+        NetworkMode: 'bridge',
+        
+        // Security
+        SecurityOpt: ['no-new-privileges'],
+        CapDrop: ['ALL'],
+        CapAdd: ['NET_BIND_SERVICE'],
+        
+        // Filesystem
+        ReadonlyRootfs: false,
+        Tmpfs: {
+          '/tmp': 'rw,noexec,nosuid,size=100m',
+          '/workspace': 'rw,exec,nosuid,size=500m'
+        }
+      },
+      
+      WorkingDir: '/workspace',
+      
+      // Keep container running
+      Cmd: ['sh', '-c', 'while true; do sleep 3600; done'],
+      
+      // Environment
+      Env: [
+        'NODE_ENV=sandbox',
+        'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
+      ]
+    });
+    
+    await container.start();
+    
+    const sandbox = {
+      sandboxId,
+      container,
+      containerId: container.id,
+      createdAt: Date.now(),
+      status: 'running'
+    };
+    
+    this.sandboxes.set(sandboxId, sandbox);
+    
+    console.log(`✅ gVisor sandbox created: ${sandboxId}`);
+    return sandbox;
+  }
+
+  async executeCommand(sandboxId, command, args = []) {
+    const sandbox = this.sandboxes.get(sandboxId);
+    if (!sandbox) throw new Error('Sandbox not found');
+    
+    const fullCommand = `${command} ${args.join(' ')}`;
+    
+    const exec = await sandbox.container.exec({
+      Cmd: ['sh', '-c', fullCommand],
+      AttachStdout: true,
+      AttachStderr: true,
+      WorkingDir: '/workspace'
+    });
+    
+    return new Promise((resolve, reject) => {
+      exec.start({ hijack: true, stdin: false }, (err, stream) => {
+        if (err) return reject(err);
+        
+        let stdout = '';
+        let stderr = '';
+        
+        stream.on('data', (chunk) => {
+          const str = chunk.toString();
+          stdout += str;
+        });
+        
+        stream.on('end', async () => {
+          const inspectData = await exec.inspect();
+          resolve({
+            exitCode: inspectData.ExitCode,
+            stdout,
+            stderr
+          });
+        });
+      });
+    });
+  }
+
+  async writeFiles(sandboxId, files) {
+    const sandbox = this.sandboxes.get(sandboxId);
+    if (!sandbox) throw new Error('Sandbox not found');
+    
+    for (const file of files) {
+      const filePath = path.join('/workspace', file.path);
+      const dir = path.dirname(filePath);
+      
+      // Create directory
+      await this.executeCommand(sandboxId, 'mkdir', ['-p', dir]);
+      
+      // Write file using echo (base64 encoded to handle special chars)
+      const base64Content = Buffer.from(file.content).toString('base64');
+      await this.executeCommand(sandboxId, 'sh', [
+        '-c',
+        `echo '${base64Content}' | base64 -d > ${filePath}`
+      ]);
+      
+      console.log(`📝 File written: ${file.path}`);
+    }
+  }
+
+  async readFile(sandboxId, filePath) {
+    const sandbox = this.sandboxes.get(sandboxId);
+    if (!sandbox) throw new Error('Sandbox not found');
+    
+    const result = await this.executeCommand(sandboxId, 'cat', [
+      path.join('/workspace', filePath)
+    ]);
+    
+    return result.stdout;
+  }
+
+  async destroySandbox(sandboxId) {
+    const sandbox = this.sandboxes.get(sandboxId);
+    if (!sandbox) return;
+    
+    console.log(`🧹 Destroying sandbox: ${sandboxId}`);
+    
+    try {
+      await sandbox.container.stop({ t: 5 });
+      await sandbox.container.remove({ force: true });
+      this.sandboxes.delete(sandboxId);
+      console.log(`✅ Sandbox destroyed: ${sandboxId}`);
+    } catch (e) {
+      console.error('⚠️ Cleanup error:', e.message);
+    }
+  }
+
+  getSandbox(sandboxId) {
+    return this.sandboxes.get(sandboxId);
+  }
+}
+
+module.exports = GVisorSandboxManager;