Skip to content

0.9.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 18 Oct 04:27
· 19 commits to main since this release
0.9.0
008d94a

gitd 0.9.0: any sandbox with a network, and many tenants on one gitd.

The endpoint: sandboxes that mount nothing

  • A Firecracker microVM, a remote sandbox (E2B, Modal, Daytona, Runloop) or a CI runner
    elsewhere clones from gitd over HTTP with a token of gitd's own: one repository for
    reading, one sandbox repository for writing, an hour unless told, a day at most, never the
    git host's credential. gitd token issue, EndpointService, the MCP tool
    open_endpoint_access, both clients.
  • Pushes land in the token's sandbox repository, never the pool; gitd publish --sandbox
    publishes the branch under the same prefix, rules, pull request and audit log as a
    workspace. End to end against GitHub on every push: a container on its own network clones
    and pushes, and gitd opens its pull request from the App's bot.
  • Served by git's own git http-backend, over TLS when given a certificate (reread when
    renewed). Partial clones from pools with the whole history.

Tenants

  • [[tenants]]: each customer of a platform its own key, roots, credentials and limits
    (workspaces, disk, fetches, sandbox repositories), and its own pools, templates,
    workspaces, tokens and audit log under <state>/tenants/<name>. Nothing is shared.
  • Every call names its tenant by its key, on the socket and the network; an endpoint token
    belongs to one tenant. Tests try every reach into another tenant's and find it refused.
  • Without tenants, nothing changes: the socket answers as in 0.8.

The API on the network

  • The network address serves the API too, to a key only: --url, --key-file,
    --ca-file on the command line, Gitd(url=…, key=…) in Python, new Gitd({ url, key })
    in TypeScript. CI calls a gitd over TLS from all three.

Kubernetes, ahead of 0.10

  • PrepareRequest.pool_inside: a workspace that names its pool from inside itself, so it
    works wherever it is mounted, accepted only while the pool is truly mounted there.

Security

0.9.0 was reviewed by an AI agent, not yet by a person; a person's review is still due.
The review found, and these were fixed before the release: a writable token could read
other sandboxes' unpublished commits through the pool's refs, and a tenant could fill the
shared disk through sandbox repositories. The threat model says what the endpoint and
tenants protect, and what they leave to the deployment.

Upgrading

The contract only grew (buf breaking against 0.8.0). Clients: pip install gitd==0.9.0,
npm install gitd-client@0.9.0. With tenants, gitd-mount needs each tenant's templates,
layers and roots, one line each.

Assets 10
Loading