653 lines
20 KiB
Go
653 lines
20 KiB
Go
//go:build linux
|
||
|
||
// sandbox_linux.go v1.5
|
||
|
||
package sandbox
|
||
|
||
import (
|
||
_ "embed"
|
||
"encoding/binary"
|
||
"encoding/json"
|
||
"errors"
|
||
"fmt"
|
||
"io"
|
||
"os"
|
||
"os/exec"
|
||
"os/user"
|
||
"path/filepath"
|
||
"strconv"
|
||
"strings"
|
||
"syscall"
|
||
"time"
|
||
|
||
"apigo.cc/gojs"
|
||
"github.com/ssgo/log"
|
||
"github.com/ssgo/u"
|
||
)
|
||
|
||
//go:embed init.gz
|
||
var initGz []byte
|
||
var initExec []byte
|
||
|
||
func init() {
|
||
initExec = u.GunzipN(initGz)
|
||
}
|
||
|
||
var defaultVolumes = []Volume{
|
||
{Source: "/usr", Target: "/usr", ReadOnly: true},
|
||
{Source: "/lib", Target: "/lib", ReadOnly: true},
|
||
{Source: "/lib64", Target: "/lib64", ReadOnly: true},
|
||
{Source: "/bin", Target: "/bin", ReadOnly: true},
|
||
{Source: "/sbin", Target: "/sbin", ReadOnly: true},
|
||
{Source: "/etc/resolv.conf", Target: "/etc/resolv.conf", ReadOnly: true},
|
||
{Source: "/etc/hosts", Target: "/etc/hosts", ReadOnly: true},
|
||
{Source: "/etc/localtime", Target: "/etc/localtime", ReadOnly: true},
|
||
{Source: "/dev/null", Target: "/dev/null", ReadOnly: false},
|
||
{Source: "/dev/urandom", Target: "/dev/urandom", ReadOnly: true},
|
||
{Source: "/dev/zero", Target: "/dev/zero", ReadOnly: true},
|
||
}
|
||
|
||
func Start(cfg *Config) (*Sandbox, error) {
|
||
s := &Sandbox{
|
||
config: cfg,
|
||
mountedList: []string{},
|
||
status: "created",
|
||
extra: map[string]any{},
|
||
}
|
||
s.lock.Lock()
|
||
defer s.lock.Unlock()
|
||
if s.status != "created" {
|
||
return nil, gojs.Err("sandbox is already used")
|
||
}
|
||
|
||
if s.config.WorkDir == "" {
|
||
s.config.WorkDir = "/app"
|
||
}
|
||
|
||
if os.Getuid() == 0 {
|
||
if user, err := user.Lookup("nobody"); err == nil {
|
||
s.uid = u.Int(user.Uid)
|
||
s.gid = u.Int(user.Gid)
|
||
} else {
|
||
s.uid = 65534
|
||
s.gid = 65534
|
||
}
|
||
}
|
||
|
||
initEnv := map[string]string{
|
||
"LANG": os.Getenv("LANG"),
|
||
"LC_TIME": os.Getenv("LC_TIME"),
|
||
"PATH": filepath.Join(s.config.WorkDir, "bin") + ":/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
||
"HOME": s.config.WorkDir,
|
||
"LD_LIBRARY_PATH": os.Getenv("LD_LIBRARY_PATH"),
|
||
}
|
||
if initEnv["LC_TIME"] == "" {
|
||
initEnv["LC_TIME"] = "C"
|
||
}
|
||
if initEnv["LANG"] == "" {
|
||
initEnv["LANG"] = "C.UTF-8"
|
||
}
|
||
addEnv := func(k, v string) {
|
||
initEnv[k] = os.Expand(v, func(varName string) string {
|
||
return initEnv[varName]
|
||
})
|
||
}
|
||
|
||
s.status = "starting"
|
||
s.startTime = time.Now().Unix()
|
||
s.id = getId()
|
||
s.root = filepath.Join(pluginConfig.Root, s.id)
|
||
|
||
// 1. 构建物理环境 (对应原 mountAll 逻辑)
|
||
initPaths := []string{s.config.WorkDir, "/var/log", "/etc", "/proc", "/sys"}
|
||
os.MkdirAll(s.root, 0755)
|
||
if s.uid != 0 {
|
||
os.Chown(s.root, s.uid, s.gid)
|
||
}
|
||
for _, p := range initPaths {
|
||
path := filepath.Join(s.root, p)
|
||
os.MkdirAll(path, 0755)
|
||
if s.uid != 0 {
|
||
os.Chown(path, s.uid, s.gid)
|
||
}
|
||
}
|
||
|
||
// 2. 执行挂载逻辑 (严格保留 v20 的 bind mount + remount ro 逻辑)
|
||
vs := NewVolumes()
|
||
vs.Add(defaultVolumes...)
|
||
vs.Add(s.config.Volumes...)
|
||
if s.config.Limits.Shm > 0 {
|
||
vs.Add(Volume{Source: "tmpfs", Target: "/dev/shm"})
|
||
}
|
||
if s.config.Limits.Tmp > 0 {
|
||
vs.Add(Volume{Source: "tmpfs", Target: "/tmp"})
|
||
}
|
||
// 处理 Gpu 透传
|
||
if len(s.config.Gpu.Devices) > 0 {
|
||
gpuDevices := []string{}
|
||
driver := strings.ToLower(s.config.Gpu.Driver)
|
||
|
||
switch driver {
|
||
case "nvidia":
|
||
// 核心管理与工具设备
|
||
gpuDevices = append(gpuDevices, "/dev/nvidiactl", "/dev/nvidia-uvm", "/dev/nvidia-uvm-tools", "/dev/nvidia-modeset")
|
||
// 具体显卡设备
|
||
if len(s.config.Gpu.Devices) > 0 && s.config.Gpu.Devices[0] == "all" {
|
||
matches, _ := filepath.Glob("/dev/nvidia[0-9]*")
|
||
gpuDevices = append(gpuDevices, matches...)
|
||
} else {
|
||
for _, devId := range s.config.Gpu.Devices {
|
||
gpuDevices = append(gpuDevices, "/dev/nvidia"+devId)
|
||
}
|
||
}
|
||
|
||
// 设置环境变量
|
||
addEnv("CUDA_HOME", os.Getenv("CUDA_HOME"))
|
||
addEnv("NVIDIA_DRIVER_CAPABILITIES", strings.Join(s.config.Gpu.Devices, ","))
|
||
|
||
case "amd", "render":
|
||
// AMD GPU 或通用的 DRM 渲染设备 (Intel 也可以走此逻辑)
|
||
// DRI (Direct Rendering Infrastructure) 设备
|
||
gpuDevices = append(gpuDevices, "/dev/kfd") // AMD 核心调度器
|
||
if len(s.config.Gpu.Devices) > 0 && s.config.Gpu.Devices[0] == "all" {
|
||
matches, _ := filepath.Glob("/dev/dri/renderD*")
|
||
gpuDevices = append(gpuDevices, matches...)
|
||
matchesCard, _ := filepath.Glob("/dev/dri/card*")
|
||
gpuDevices = append(gpuDevices, matchesCard...)
|
||
} else {
|
||
for _, devId := range s.config.Gpu.Devices {
|
||
// 常见的 ID 如 128 (renderD128)
|
||
gpuDevices = append(gpuDevices, "/dev/dri/renderD"+devId)
|
||
}
|
||
}
|
||
addEnv("ROCR_VISIBLE_DEVICES", strings.Join(s.config.Gpu.Devices, ","))
|
||
// 对于某些旧版 OpenCL
|
||
addEnv("GPU_DEVICE_ORDINAL", strings.Join(s.config.Gpu.Devices, ","))
|
||
|
||
case "intel":
|
||
// Intel 特有的设备节点通常就在 /dev/dri 目录下
|
||
if len(s.config.Gpu.Devices) > 0 && s.config.Gpu.Devices[0] == "all" {
|
||
matches, _ := filepath.Glob("/dev/dri/*")
|
||
gpuDevices = append(gpuDevices, matches...)
|
||
} else {
|
||
for _, devId := range s.config.Gpu.Devices {
|
||
gpuDevices = append(gpuDevices, "/dev/dri/renderD"+devId)
|
||
}
|
||
}
|
||
addEnv("ONEAPI_DEVICE_SELECTOR", "level_zero:"+strings.Join(s.config.Gpu.Devices, ","))
|
||
}
|
||
|
||
// 统一执行设备挂载
|
||
for _, dev := range gpuDevices {
|
||
if u.FileExists(dev) {
|
||
vs.Add(Volume{Source: dev, Target: dev})
|
||
}
|
||
}
|
||
}
|
||
|
||
// 处理 ProjectDir 自动挂载
|
||
if s.config.ProjectDir != "" {
|
||
s.workDir = u.GetAbsFilename(s.config.ProjectDir)
|
||
} else {
|
||
// 使用临时目录
|
||
s.workDir = filepath.Join(s.root, ".workdir")
|
||
}
|
||
|
||
if !u.FileExists(s.workDir) {
|
||
os.MkdirAll(s.workDir, 0755)
|
||
if s.uid != 0 {
|
||
os.Chown(s.workDir, s.uid, s.gid)
|
||
}
|
||
}
|
||
vs.Add(Volume{Source: s.workDir, Target: s.config.WorkDir})
|
||
|
||
// 处理 runtime
|
||
runtimeListLock.RLock()
|
||
rt := runtimeList[s.config.Runtime.Language]
|
||
runtimeListLock.RUnlock()
|
||
if rt != nil {
|
||
rtCfg := pluginConfig.Runtime[s.config.Runtime.Language]
|
||
if rtCfg == nil {
|
||
rtCfg = &RuntimeConfig{}
|
||
}
|
||
if rtCfg.Root == "" {
|
||
rtCfg.Root = filepath.Join(pluginConfig.Root, s.config.Runtime.Language)
|
||
}
|
||
runtimePath := filepath.Join(rtCfg.Root, "runtime", s.config.Runtime.Version)
|
||
venvPath := filepath.Join(rtCfg.Root, "venv", fmt.Sprintf("%s_%s", s.config.Runtime.Version, s.config.Runtime.Venv))
|
||
if rtsbCfg, err := rt.Check(runtimePath, venvPath, s.config.ProjectDir, s.uid, s.gid, rtCfg); err == nil {
|
||
if s.config.StartCmd == "" && rtsbCfg.StartCmd != "" {
|
||
s.config.StartCmd = rtsbCfg.StartCmd
|
||
}
|
||
for k, v := range rtsbCfg.Envs {
|
||
addEnv(k, v)
|
||
}
|
||
// 挂载运行时环境
|
||
if u.FileExists(runtimePath) {
|
||
vs.Add(Volume{Source: runtimePath, Target: runtimePath, ReadOnly: true})
|
||
}
|
||
if u.FileExists(venvPath) {
|
||
vs.Add(Volume{Source: venvPath, Target: venvPath, ReadOnly: false})
|
||
}
|
||
} else {
|
||
s._cleanup()
|
||
return nil, err
|
||
}
|
||
} else {
|
||
s._cleanup()
|
||
return nil, gojs.Err("runtime not found for language " + s.config.Runtime.Language)
|
||
}
|
||
|
||
if s.config.StartCmd == "" {
|
||
s._cleanup()
|
||
return nil, gojs.Err("start cmd is empty")
|
||
}
|
||
|
||
for k, v := range s.config.Envs {
|
||
addEnv(k, v)
|
||
}
|
||
|
||
for _, v := range vs.Get() {
|
||
from, to, mode := v.Source, v.Target, "rw"
|
||
if v.ReadOnly {
|
||
mode = "ro"
|
||
}
|
||
|
||
toPath := filepath.Join(s.root, to)
|
||
fi, err := os.Lstat(from)
|
||
|
||
if err == nil && fi.Mode()&os.ModeSymlink != 0 {
|
||
// 处理符号链接
|
||
linkTarget, _ := os.Readlink(from)
|
||
os.Symlink(linkTarget, toPath)
|
||
} else {
|
||
// 创建挂载点
|
||
if err != nil || fi.IsDir() {
|
||
// 创建文件夹（如果err!=nil表示这是特殊文件夹例如/proc所以也要创建文件夹）
|
||
os.MkdirAll(toPath, 0755)
|
||
if s.uid != 0 {
|
||
os.Chown(toPath, s.uid, s.gid)
|
||
}
|
||
} else {
|
||
// 写入空文件（u.WriteFile会自动创建文件夹）
|
||
u.WriteFile(toPath, "")
|
||
if s.uid != 0 {
|
||
os.Chown(toPath, s.uid, s.gid)
|
||
}
|
||
}
|
||
|
||
// 挂载操作
|
||
var flags uintptr = syscall.MS_BIND | syscall.MS_REC
|
||
fsType, opt := "", ""
|
||
if from == "tmpfs" {
|
||
fsType = "tmpfs"
|
||
flags = 0
|
||
// 根据配置处理 shm/tmp 大小
|
||
if to == "/dev/shm" && s.config.Limits.Shm > 0 {
|
||
opt = "size=" + strconv.FormatUint(uint64(s.config.Limits.Shm), 10) + "m"
|
||
} else if to == "/tmp" && s.config.Limits.Tmp > 0 {
|
||
opt = "size=" + strconv.FormatUint(uint64(s.config.Limits.Tmp), 10) + "m"
|
||
}
|
||
}
|
||
|
||
err = syscall.Mount(from, toPath, fsType, flags, opt)
|
||
if mode == "ro" && err == nil && fsType == "" {
|
||
// bind模式下ReadOnly需要二次挂载才能实现
|
||
syscall.Mount("", toPath, "", flags|syscall.MS_REMOUNT|syscall.MS_RDONLY, "")
|
||
} else if s.uid != 0 && mode != "ro" && fsType == "" && !strings.HasPrefix(to, "/dev") {
|
||
// 可写的普通挂载，设置为用户权限
|
||
os.Lchown(toPath, s.uid, s.gid)
|
||
}
|
||
s.assertLog(fmt.Sprintf("Mount %s to %s", from, toPath), err, "id", s.id, "name", s.config.Name, "workDir", s.workDir, "readonly", v.ReadOnly)
|
||
if err == nil {
|
||
s.mountedList = append(s.mountedList, toPath)
|
||
}
|
||
}
|
||
}
|
||
// 容器内会自动挂载/proc和/sys，需要在结束时自动卸载
|
||
s.mountedList = append(s.mountedList, filepath.Join(s.root, "/proc"), filepath.Join(s.root, "/sys"))
|
||
|
||
// 3. Cgroup v2 资源限制
|
||
cgPath := "/sys/fs/cgroup/" + s.id
|
||
enableCgroup := false
|
||
if s.config.Limits.Mem >= 0.0001 {
|
||
err := u.WriteFile(filepath.Join(cgPath, "memory.max"), u.String(int64(s.config.Limits.Mem*1024*1024*1024)))
|
||
s.assertLog(fmt.Sprintf("Write %s to %s", u.String(s.config.Limits.Mem*1024*1024*1024), filepath.Join(cgPath, "memory.max")), err, "id", s.id, "name", s.config.Name, "workDir", s.workDir)
|
||
if err == nil {
|
||
enableCgroup = true
|
||
}
|
||
}
|
||
if s.config.Limits.Swap >= 0.0001 || s.config.Limits.Mem >= 0.0001 {
|
||
err := u.WriteFile(filepath.Join(cgPath, "memory.swap.max"), u.String(int64(s.config.Limits.Swap*1024*1024*1024)))
|
||
s.assertLog(fmt.Sprintf("Write %s to %s", u.String(s.config.Limits.Swap*1024*1024*1024), filepath.Join(cgPath, "memory.swap.max")), err, "id", s.id, "name", s.config.Name, "workDir", s.workDir)
|
||
if err == nil {
|
||
enableCgroup = true
|
||
}
|
||
}
|
||
|
||
if s.config.Limits.Cpu >= 0.0001 {
|
||
err := u.WriteFile(filepath.Join(cgPath, "cpu.max"), fmt.Sprintf("%d 100000", int(s.config.Limits.Cpu*100000)))
|
||
s.assertLog(fmt.Sprintf("Write %s to %s", fmt.Sprintf("%d 100000", int(s.config.Limits.Cpu*100000)), filepath.Join(cgPath, "cpu.max")), err, "id", s.id, "name", s.config.Name, "workDir", s.workDir)
|
||
if err == nil {
|
||
enableCgroup = true
|
||
}
|
||
}
|
||
if (s.config.Limits.Mem >= 0.0001 || s.config.Limits.Swap >= 0.0001 || s.config.Limits.Cpu >= 0.0001) && !enableCgroup {
|
||
// 至少有一个资源限制才会启用 Cgroup v2，不支持非 root 或 docker 环境
|
||
log.DefaultLogger.Warning("[Sandbox] cgroup v2 resource limit not enabled, please check is running as root or in docker?", "id", s.id, "name", s.config.Name, "workDir", s.workDir, "mem", s.config.Limits.Mem, "swap", s.config.Limits.Swap, "cpu", s.config.Limits.Cpu)
|
||
}
|
||
|
||
// 4. 部署引导程序
|
||
initFile := filepath.Join(s.root, "/init")
|
||
os.WriteFile(initFile, initExec, 0755)
|
||
|
||
// 启动引导进程 (注意：此时不再在 Go 层设置 Chroot，交由 init 处理)
|
||
netEnabled := uint8(0)
|
||
cloneFlags := syscall.CLONE_NEWNS | syscall.CLONE_NEWPID | syscall.CLONE_NEWUTS
|
||
if !s.config.Network.AllowInternet && !s.config.Network.AllowLocalNetwork && len(s.config.Network.AllowListen) == 0 && len(s.config.Network.AllowList) == 0 {
|
||
cloneFlags |= syscall.CLONE_NEWNET
|
||
} else {
|
||
netEnabled = 1
|
||
}
|
||
cmdSysProcAttr := &syscall.SysProcAttr{
|
||
Chroot: s.root, // Go 依然需要先将进程禁锢在 root 目录下
|
||
Cloneflags: uintptr(cloneFlags),
|
||
}
|
||
|
||
// 设置环境变量（支持变量引用）
|
||
cmdEnv := make([]string, 0, len(initEnv))
|
||
for k, v := range initEnv {
|
||
cmdEnv = append(cmdEnv, fmt.Sprintf("%s=%s", k, v))
|
||
}
|
||
|
||
// 启动 init 进程
|
||
var cmdStdin io.WriteCloser
|
||
for i := 0; i < 10; i++ {
|
||
time.Sleep(time.Millisecond)
|
||
s.cmd = exec.Command("/init")
|
||
s.cmd.SysProcAttr = cmdSysProcAttr
|
||
s.cmd.Env = cmdEnv
|
||
stdin, err := s.cmd.StdinPipe()
|
||
if err != nil {
|
||
s._cleanup()
|
||
return nil, err
|
||
}
|
||
s.cmd.Stdout = os.Stdout
|
||
s.cmd.Stderr = os.Stderr
|
||
|
||
if err := s.cmd.Start(); err != nil {
|
||
stdin.Close()
|
||
if !errors.Is(err, syscall.ETXTBSY) {
|
||
s._cleanup()
|
||
return nil, err
|
||
}
|
||
if i >= 3 {
|
||
s.log("init ETXTBSY", "retry", i)
|
||
}
|
||
} else {
|
||
cmdStdin = stdin
|
||
break
|
||
}
|
||
}
|
||
if cmdStdin == nil {
|
||
s._cleanup()
|
||
return nil, fmt.Errorf("init start failed")
|
||
}
|
||
|
||
err := os.Remove(initFile)
|
||
s.assertLog("remove init file", err, "id", s.id, "name", s.config.Name, "initFile", initFile)
|
||
|
||
s.pid = s.cmd.Process.Pid
|
||
|
||
// 6. 完成后续状态记录
|
||
if enableCgroup {
|
||
err := os.WriteFile(filepath.Join(cgPath, "cgroup.procs"), []byte(strconv.Itoa(s.pid)), 0644)
|
||
s.assertLog(fmt.Sprintf("Write %s to %s", strconv.Itoa(s.pid), filepath.Join(cgPath, "cgroup.procs")), err, "id", s.id, "name", s.config.Name, "workDir", s.workDir)
|
||
}
|
||
|
||
// 检查Cgroup
|
||
// fmt.Println(u.BMagenta(filepath.Join(cgPath, "cpu.max")), u.ReadFileN(filepath.Join(cgPath, "cpu.max")))
|
||
// fmt.Println(u.BMagenta(filepath.Join(cgPath, "memory.max")), u.ReadFileN(filepath.Join(cgPath, "memory.max")))
|
||
// fmt.Println(u.BMagenta(filepath.Join(cgPath, "memory.swap.max")), u.ReadFileN(filepath.Join(cgPath, "memory.swap.max")))
|
||
// fmt.Println(u.BMagenta(filepath.Join(cgPath, "cgroup.procs")), u.ReadFileN(filepath.Join(cgPath, "cgroup.procs")))
|
||
|
||
// 7. 按照协议发送配置信息 (LittleEndian, 匹配 C 端的 uint32_t)
|
||
// 写入 UID & GID
|
||
binary.Write(cmdStdin, binary.LittleEndian, uint32(s.uid))
|
||
binary.Write(cmdStdin, binary.LittleEndian, uint32(s.gid))
|
||
|
||
// 写入 WorkDir
|
||
binary.Write(cmdStdin, binary.LittleEndian, uint32(len(s.config.WorkDir)))
|
||
cmdStdin.Write([]byte(s.config.WorkDir))
|
||
|
||
// 写入 Args
|
||
allArgs := append([]string{s.config.StartCmd}, s.config.StartArgs...)
|
||
binary.Write(cmdStdin, binary.LittleEndian, uint32(len(allArgs)))
|
||
for _, arg := range allArgs {
|
||
binary.Write(cmdStdin, binary.LittleEndian, uint32(len(arg)))
|
||
cmdStdin.Write([]byte(arg))
|
||
}
|
||
|
||
// 写入网络配置总开关
|
||
binary.Write(cmdStdin, binary.LittleEndian, netEnabled)
|
||
if netEnabled == 1 {
|
||
// 1. 基础开关 (各1字节)
|
||
binary.Write(cmdStdin, binary.LittleEndian, u.If(s.config.Network.AllowInternet, uint8(1), uint8(0)))
|
||
binary.Write(cmdStdin, binary.LittleEndian, u.If(s.config.Network.AllowLocalNetwork, uint8(1), uint8(0)))
|
||
|
||
// 2. AllowListen (端口列表)
|
||
binary.Write(cmdStdin, binary.LittleEndian, uint32(len(s.config.Network.AllowListen)))
|
||
for _, port := range s.config.Network.AllowListen {
|
||
binary.Write(cmdStdin, binary.LittleEndian, uint32(port))
|
||
}
|
||
|
||
// 3. 解析并发送 AllowList
|
||
allowRules := []NetRule{}
|
||
for _, s := range s.config.Network.AllowList {
|
||
if r, err := ParseNetRule(s); err == nil {
|
||
allowRules = append(allowRules, *r)
|
||
}
|
||
}
|
||
binary.Write(cmdStdin, binary.LittleEndian, uint32(len(allowRules)))
|
||
for _, r := range allowRules {
|
||
binary.Write(cmdStdin, binary.LittleEndian, r)
|
||
}
|
||
|
||
// 4. 解析并发送 BlockList
|
||
blockRules := []NetRule{}
|
||
for _, s := range s.config.Network.BlockList {
|
||
if r, err := ParseNetRule(s); err == nil {
|
||
blockRules = append(blockRules, *r)
|
||
}
|
||
}
|
||
binary.Write(cmdStdin, binary.LittleEndian, uint32(len(blockRules)))
|
||
for _, r := range blockRules {
|
||
binary.Write(cmdStdin, binary.LittleEndian, r)
|
||
}
|
||
}
|
||
|
||
// 必须主动关闭，触发 EOF 并释放 fd
|
||
cmdStdin.Close()
|
||
|
||
s.status = "running"
|
||
u.Save(filepath.Join(s.root, ".state.json"), State{
|
||
Id: s.id,
|
||
Pid: s.pid,
|
||
StartTime: s.startTime,
|
||
WorkDir: s.workDir,
|
||
MountedList: s.mountedList,
|
||
})
|
||
RegisterSandbox(s)
|
||
return s, nil
|
||
}
|
||
|
||
func (s *Sandbox) Kill() error {
|
||
s.lock.Lock()
|
||
defer s.lock.Unlock()
|
||
if s.status != "running" && s.status != "starting" {
|
||
return gojs.Err("sandbox not running or starting")
|
||
}
|
||
s.status = "stopping"
|
||
return s._kill(syscall.SIGTERM)
|
||
}
|
||
|
||
func (s *Sandbox) Wait(timeout int64) (any, error) {
|
||
s.lock.Lock()
|
||
defer s.lock.Unlock()
|
||
if s.status != "running" && s.status != "stopping" {
|
||
return nil, gojs.Err("sandbox not running or stopping")
|
||
}
|
||
|
||
if s._alive() {
|
||
ch := make(chan error, 1)
|
||
go func() {
|
||
state, err := s._waitProcess()
|
||
if err == nil && state != nil {
|
||
s.status = "exited"
|
||
}
|
||
ch <- err
|
||
}()
|
||
|
||
select {
|
||
case _ = <-ch:
|
||
break
|
||
case <-time.After(time.Duration(timeout) * time.Millisecond):
|
||
s._kill(syscall.SIGKILL)
|
||
break
|
||
}
|
||
}
|
||
|
||
return s._cleanup()
|
||
}
|
||
|
||
func (s *Sandbox) Cleanup() (any, error) {
|
||
s.lock.Lock()
|
||
defer s.lock.Unlock()
|
||
return s._cleanup()
|
||
}
|
||
|
||
func (s *Sandbox) _cleanup() (any, error) {
|
||
s.log("cleaning up sandbox", "id", s.id, "name", s.config.Name, "workDir", s.workDir)
|
||
cgPath := "/sys/fs/cgroup/" + s.id
|
||
if u.FileExists(cgPath) {
|
||
killPath := filepath.Join(cgPath, "cgroup.kill")
|
||
if _, err := os.Stat(killPath); err == nil {
|
||
_ = os.WriteFile(killPath, []byte("1"), 0644)
|
||
time.Sleep(10 * time.Millisecond) // 稍等片刻让内核处理完毕
|
||
}
|
||
err := os.RemoveAll(cgPath)
|
||
s.assertLog(fmt.Sprintf("Remove Cgroup %s", cgPath), err, "id", s.id, "name", s.config.Name, "workDir", s.workDir)
|
||
}
|
||
|
||
for i := len(s.mountedList) - 1; i >= 0; i-- {
|
||
err := syscall.Unmount(s.mountedList[i], syscall.MNT_DETACH)
|
||
// 忽略 /proc 和 /sys 挂载失败提示
|
||
if err == nil || (!strings.HasSuffix(s.mountedList[i], "/proc") && !strings.HasSuffix(s.mountedList[i], "/sys")) {
|
||
s.assertLog(fmt.Sprintf("Unmount %s", s.mountedList[i]), err, "id", s.id, "name", s.config.Name, "workDir", s.workDir)
|
||
}
|
||
}
|
||
|
||
_, err := copyLog(s.workDir, s.startTime)
|
||
s.assertLog("Copy log to logs directory", err, "id", s.id, "name", s.config.Name, "workDir", s.workDir)
|
||
outLog := u.ReadFileN(filepath.Join(s.workDir, "stdout.log"))
|
||
errLog := u.ReadFileN(filepath.Join(s.workDir, "stderr.log"))
|
||
|
||
err = os.RemoveAll(s.root)
|
||
s.assertLog(fmt.Sprintf("Remove Sandbox %s", s.root), err, "id", s.id, "name", s.config.Name, "workDir", s.workDir)
|
||
releaseId(s.id)
|
||
ReleaseSandbox(s.id)
|
||
|
||
var outData any = outLog
|
||
if strings.HasPrefix(outLog, "{") && strings.HasSuffix(outLog, "}") || strings.HasPrefix(outLog, "[") && strings.HasSuffix(outLog, "]") {
|
||
var data map[string]any
|
||
if err := json.Unmarshal([]byte(outLog), &data); err == nil {
|
||
outData = data
|
||
}
|
||
}
|
||
|
||
if errLog != "" {
|
||
return outData, errors.New(errLog)
|
||
}
|
||
return outData, nil
|
||
}
|
||
|
||
// 建议在 struct 中增加字段记录上次采样，或者由调用方维护
|
||
// 这里提供一个逻辑更健壮的单次查询版本
|
||
|
||
func (s *Sandbox) Status() Status {
|
||
st := Status{
|
||
Id: s.id,
|
||
Pid: s.pid,
|
||
Alive: s._alive(),
|
||
Status: s.status,
|
||
StartTime: s.startTime,
|
||
}
|
||
|
||
// 统一处理 Uptime，避免除零错误
|
||
now := time.Now().Unix()
|
||
st.Uptime = now - s.startTime
|
||
if st.Uptime <= 0 {
|
||
st.Uptime = 1
|
||
}
|
||
|
||
cgPath := "/sys/fs/cgroup/" + s.id
|
||
hasCgroup := u.FileExists(cgPath)
|
||
|
||
// 1. 内存统计
|
||
if hasCgroup {
|
||
if data, err := os.ReadFile(filepath.Join(cgPath, "memory.current")); err == nil {
|
||
usage, _ := strconv.ParseUint(strings.TrimSpace(string(data)), 10, 64)
|
||
st.MemoryUsage = uint(usage / 1024 / 1024)
|
||
}
|
||
} else {
|
||
// 非 Cgroup 模式下，读取 VmRSS (物理内存占用)，比 statm 更直观
|
||
if data, err := os.ReadFile(fmt.Sprintf("/proc/%d/status", st.Pid)); err == nil {
|
||
lines := strings.Split(string(data), "\n")
|
||
for _, line := range lines {
|
||
if strings.HasPrefix(line, "VmRSS:") {
|
||
fields := strings.Fields(line)
|
||
if len(fields) >= 2 {
|
||
val, _ := strconv.ParseUint(fields[1], 10, 64)
|
||
st.MemoryUsage = uint(val / 1024) // status 里通常是 KB
|
||
}
|
||
break
|
||
}
|
||
}
|
||
}
|
||
}
|
||
|
||
// 2. CPU 统计
|
||
if hasCgroup {
|
||
if data, err := os.ReadFile(filepath.Join(cgPath, "cpu.stat")); err == nil {
|
||
for _, line := range strings.Split(string(data), "\n") {
|
||
if strings.HasPrefix(line, "usage_usec") {
|
||
parts := strings.Fields(line)
|
||
if len(parts) >= 2 {
|
||
usageUsec, _ := strconv.ParseFloat(parts[1], 64)
|
||
// 计算全生命周期平均负载
|
||
// 如果要瞬时负载，需在外部存储上次的 usageUsec 和时间戳做 delta
|
||
st.CpuUsage = (usageUsec / (float64(st.Uptime) * 1000000.0)) * 100
|
||
}
|
||
break
|
||
}
|
||
}
|
||
}
|
||
} else {
|
||
if data, err := os.ReadFile(fmt.Sprintf("/proc/%d/stat", st.Pid)); err == nil {
|
||
fields := strings.Fields(string(data))
|
||
if len(fields) > 14 {
|
||
// utime(14) + stime(15)
|
||
utime, _ := strconv.ParseFloat(fields[13], 64)
|
||
stime, _ := strconv.ParseFloat(fields[14], 64)
|
||
|
||
// 这里的 100 是单核系数，多核环境下建议除以 runtime.NumCPU()
|
||
totalSec := (utime + stime) / 100.0
|
||
st.CpuUsage = (totalSec / float64(st.Uptime)) * 100
|
||
}
|
||
}
|
||
}
|
||
|
||
// 修正：如果 CPU 计算结果超过 100% (多核情况)，保持原样展示或按需缩放
|
||
return st
|
||
}
|