v0.5.1

v0.5.0 -> v0.5.1

Summary

Remove Podman container dependency and refactor to use bubblewrap sandbox with enhanced security hardening including network isolation and capability restrictions.

翻譯

移除 Podman 容器相依性，重構為使用 bubblewrap 沙箱執行，並強化安全設定包括網路隔離與權限限制。

Changes

REFACTOR

• Remove entire internal/container/ package (build, container, health, operator)
• Consolidate RunBody and RunNowBody structs into single RunBody
• Extract getRunBody(), getCodeMaxSize(), run(), setStream() helper functions
• Remove commented-out Podman execution code from handlers

翻譯

• 移除整個 internal/container/ 套件（build、container、health、operator）
• 合併 RunBody 與 RunNowBody 結構為單一 RunBody
• 抽離 getRunBody()、getCodeMaxSize()、run()、setStream() 輔助函式
• 移除 handlers 中已註解的 Podman 執行程式碼

SECURITY

• Enable network isolation with --unshare-net (previously --share-net)
• Add --new-session to prevent TTY hijacking
• Add --cap-drop ALL to remove all capabilities
• Remove /bin and /sbin bind mounts to reduce attack surface
• Add sandbox home directory /home/sandbox with tmpfs
• Clear sensitive environment variables (LD_PRELOAD, LD_LIBRARY_PATH)
• Set explicit locale and temp directory environment

翻譯

• 啟用網路隔離 --unshare-net（原為 --share-net）
• 新增 --new-session 防止 TTY 劫持
• 新增 --cap-drop ALL 移除所有 capabilities
• 移除 /bin 與 /sbin 綁定掛載以縮小攻擊面
• 新增沙箱家目錄 /home/sandbox 使用 tmpfs
• 清除敏感環境變數（LD_PRELOAD、LD_LIBRARY_PATH）
• 設定明確的語系與暫存目錄環境變數

---

Files Changed

File	Status	Tag
internal/container/build.go	Deleted	REFACTOR
internal/container/container.go	Deleted	REFACTOR
internal/container/health.go	Deleted	REFACTOR
internal/container/operator.go	Deleted	REFACTOR
internal/handler/run.go	Modified	REFACTOR
internal/handler/sse.go	Modified	REFACTOR
internal/sandbox/command.go	Modified	SECURITY
.gitignore	Modified	CHORE
package-lock.json	Added	CHORE

---

Generated by SKILL