lunanting/ai-chatbot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(canvas-agent): apply core dump limit to sandbox process tree

Browse Source
This commit is contained in:
134 2026-10-20 17:44:59 +08:00
parent 1e2f76a79f
commit 311d2eed8f
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
services/zcode-agent/sandbox.mjs
View File

@ -11,11 +11,11 @@ export async function sandboxCommand(options) {
CANVAS_AGENT_RUN_TOKEN: token, NODE_OPTIONS: '--max-old-space-size=512' };
if (platform === 'linux') {
if (process.getuid?.() !== 0 || !Number.isSafeInteger(uid) || uid < 200000) throw new Error('Linux Agent 沙箱需要受控的独立运行 UID');
for (const file of ['/usr/bin/bwrap', '/usr/bin/setpriv', '/usr/bin/systemd-run'])
for (const file of ['/usr/bin/bwrap', '/usr/bin/setpriv', '/usr/bin/systemd-run', '/usr/bin/prlimit'])
if (!existsSync(file)) throw new Error('缺少 Linux Agent 沙箱组件，禁止宿主直接执行');
const args = ['--quiet', '--scope', '--collect', `--unit=yedir-canvas-${options.runId}`,
'--property=LimitCORE=0', '--property=MemoryMax=1073741824', '--property=TasksMax=128', '--property=CPUQuota=200%',
'/usr/bin/setpriv', `--reuid=${uid}`, `--regid=${uid}`, '--clear-groups',
'--property=MemoryMax=1073741824', '--property=TasksMax=128', '--property=CPUQuota=200%',
'/usr/bin/prlimit', '--core=0:0', '--', '/usr/bin/setpriv', `--reuid=${uid}`, `--regid=${uid}`, '--clear-groups',
'/usr/bin/bwrap', '--unshare-all', '--new-session', '--die-with-parent', '--cap-drop', 'ALL', '--clearenv',
'--ro-bind', '/usr', '/usr', '--ro-bind', '/lib64', '/lib64', '--symlink', 'usr/bin', '/bin', '--symlink', 'usr/lib', '/lib',
'--ro-bind', runtimeDir, '/runtime', '--bind', home, '/home/agent', '--bind', workspace, '/workspace',