Add IsolationSpec and LocalInterpreter subprocess mode - #1
Open
MaximeRivest wants to merge 1 commit into
Open
Conversation
Add a guarantee-based isolation vocabulary (dspy_interpreters.isolation) and a LocalInterpreter(mode="subprocess", isolation=IsolationSpec(...)) mode that runs generated code in a separate local worker process behind OS confinement. - IsolationSpec names portable guarantees (filesystem_allowlist, no_ambient_network, memory_capped, cpu_time_capped, process_count_capped, wall_time_capped, clean_environment, private_tmp, killed_with_host, no_new_privileges, reduced_kernel_surface). A backend that cannot provide a requested guarantee refuses with IsolationUnsupportedError; it never downgrades silently. probe() reports what the machine can enforce and isolation_report shows the mechanism behind each guarantee after start. - Worker script (stdlib + ctypes) speaks the Modal-style JSON-lines protocol on private fds and applies the policy ratchet before serving: rlimits, PR_SET_PDEATHSIG, Landlock, unshare(CLONE_NEWUSER|CLONE_NEWNET), PR_SET_NO_NEW_PRIVS, seccomp-bpf denylist (x86_64, aarch64). - Linux backend: bwrap or native (Landlock + namespaces + seccomp) launcher, cgroup v2 caps through systemd-run --user --scope with rlimit fallbacks. - macOS backend: sandbox-exec Seatbelt profile (experimental), RLIMIT_CPU, RLIMIT_NPROC, ppid watchdog; memory caps refused. - Windows backend: Job Object memory/CPU/process caps and kill-on-close; filesystem allowlist and no-network refused (AppContainer not implemented). - Plain backend on any OS for an unconfined worker process. - Tests: worker protocol and ratchet, plain and confined conformance suites, Linux live tests for both launchers, plan/profile/struct tests for macOS and Windows, spec validation. Only Linux was exercised live. - Docs: docs/isolation.md, README security table and usage, abstraction-boundaries note, run_conformance subprocess entry. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TxvuSh9guNNcZKpWrQe4RA
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
this PR is to share example code on how local, native language interpreters (not wasm) could be isolated using native operating system tooling.
see the first 70 lines of: docs/isolation.md to get an idea of the purpose / value of this.
to get a sense of what it takes to accomplish this, see:
src/dspy_interpreters/isolation/_plain.pysrc/dspy_interpreters/isolation/_darwin.pysrc/dspy_interpreters/isolation/_windows.pythis is just meant to inform and 'stash' the general approach for properly implemented version if you see the value.