Update simple-sandbox-manager.js

simple-sandbox-manager.js

@@ -12,11 +12,32 @@ class SimpleSandboxManager extends EventEmitter {
     this.portCounter = 3000;
     this.streamClients = new Map();
     this.commandData = new Map();
+    this.gvisorAvailable = false;
   }
 
   async initialize() {
     await fs.mkdir(this.basePath, { recursive: true });
-    console.log('✅ Namespace-Isolated Sandbox Manager initialized');
+    
+    // Check if gVisor is available
+    try {
+      await new Promise((resolve, reject) => {
+        exec('runsc --version', (error, stdout) => {
+          if (error) {
+            console.warn('⚠️ gVisor not available, falling back to direct execution');
+            this.gvisorAvailable = false;
+            resolve();
+          } else {
+            console.log('✅ gVisor available:', stdout.trim());
+            this.gvisorAvailable = true;
+            resolve();
+          }
+        });
+      });
+    } catch (e) {
+      this.gvisorAvailable = false;
+    }
+    
+    console.log(`✅ Sandbox Manager initialized (gVisor: ${this.gvisorAvailable ? 'enabled' : 'disabled'})`);
   }
 
   async createSandbox(sandboxId, options = {}) {
@@ -27,12 +48,20 @@ class SimpleSandboxManager extends EventEmitter {
     const workspacePath = path.join(sandboxPath, 'workspace');
     await fs.mkdir(workspacePath, { recursive: true });
     
+    // Create rootfs structure for gVisor
+    const rootfsPath = path.join(sandboxPath, 'rootfs');
+    await fs.mkdir(rootfsPath, { recursive: true });
+    await fs.mkdir(path.join(rootfsPath, 'tmp'), { recursive: true });
+    await fs.mkdir(path.join(rootfsPath, 'proc'), { recursive: true });
+    await fs.mkdir(path.join(rootfsPath, 'dev'), { recursive: true });
+    
     const port = this.portCounter++;
     
     const sandbox = {
       sandboxId,
       path: sandboxPath,
       workspacePath,
+      rootfsPath,
       port,
       exposedPorts: ports,
       timeout,
@@ -42,7 +71,7 @@ class SimpleSandboxManager extends EventEmitter {
     };
     
     this.sandboxes.set(sandboxId, sandbox);
-    console.log(`✅ Sandbox created: ${sandboxId} (port: ${port}, timeout: ${timeout}ms)`);
+    console.log(`✅ Sandbox created: ${sandboxId} (port: ${port}, gVisor: ${this.gvisorAvailable})`);
     
     return sandbox;
   }
@@ -90,18 +119,24 @@ class SimpleSandboxManager extends EventEmitter {
     const { background = false, timeout = 300000 } = options;
     const fullCommand = `${command} ${args.join(' ')}`;
     
-    // ✅ NO WHITELIST - Uses Linux namespaces for isolation
-    // unshare creates isolated namespace environment:
-    // --net: Network namespace (isolated network stack)
-    // --pid: PID namespace (can't see/kill external processes)
-    // --mount: Mount namespace (isolated filesystem view)
-    // --fork: Fork into namespace before executing
-    const isolatedCommand = `
-      unshare --net --pid --mount --fork sh -c "
-        cd ${sandbox.workspacePath}
-        ${fullCommand}
-      "
-    `;
+    let isolatedCommand;
+    
+    if (this.gvisorAvailable) {
+      // ✅ Try gVisor execution
+      // Create OCI bundle configuration
+      const bundlePath = path.join(sandbox.path, 'bundle');
+      await fs.mkdir(bundlePath, { recursive: true });
+      
+      // gVisor command with runsc
+      isolatedCommand = `runsc --rootless=true --network=none run -bundle ${bundlePath} sh -c "cd /workspace && ${fullCommand}"`;
+      
+      console.log(`🛡️ Running with gVisor: ${command}`);
+    } else {
+      // ❌ Fallback to direct execution with resource limits
+      isolatedCommand = `sh -c "cd ${sandbox.workspacePath} && ulimit -t 300 -v 1048576 && timeout 300s ${fullCommand}"`;
+      
+      console.log(`⚠️ Running without isolation: ${command}`);
+    }
     
     if (background) {
       return this.startBackgroundProcess(sandboxId, isolatedCommand, sandbox.path, sandbox.port);
@@ -268,12 +303,10 @@ class SimpleSandboxManager extends EventEmitter {
       const filePath = file.path;
       let fileContent = file.content;
       
-      // Handle object content (JSON files)
       if (typeof fileContent === 'object' && fileContent !== null) {
         fileContent = JSON.stringify(fileContent, null, 2);
       }
       
-      // Ensure string
       if (typeof fileContent !== 'string') {
         fileContent = String(fileContent);
       }