0 Fork 0

Files

T

vhaudiquet c1059c23e0 build: the cloud frontend stands alone

The Durable Object, the sandbox daemon, and their deploy assets
leave the rhema workspace for a repository of their own. The DO
was already a deployment artifact (publish = false, worker feature
wasm-only), and rhema-sandbox-server's only consumer was the image
beside it — both are product, not framework. The harness and the
seam stay behind: rhema-cloud-agent and the sandbox family join
the rhema repository's publish list, and this tree consumes them
from crates.io at 0.2.6, the same arrangement the claw keeps its
framework crates under.

The sandboxd image build carries the fix its extraction needed:
the old Dockerfile still staged the claw's workspace (claw and
tools manifests, integrations globs, the vendored crossterm) and
missed rhema-provider-registry's manifest entirely. The manifest
stage is now this workspace's two members, fetched from the
registry.

Not yet buildable: the rhema 0.2.6 batch (rhema-sandbox,
-local, -http, rhema-cloud-agent) must publish first — then one
cargo check generates Cargo.lock and CI goes green.

2026-11-13 12:05:30 +01:00

README.md

build: the cloud frontend stands alone

2026-11-13 12:05:30 +01:00

sandboxd.Dockerfile

build: the cloud frontend stands alone

2026-11-13 12:05:30 +01:00

README.md

Docker images

Every Dockerfile here builds from the repository root as its context:

docker build -f deploy/docker/<name>.Dockerfile -t <name> .

rhema-sandboxd

The sandbox wire protocol served from a host: one root directory per session under a fixed base, bash -c exec under a timeout budget, files and seeds on the fs, the token checked on every route (specs/rhema-sandbox.md §3).

Build and run:

docker build -f deploy/docker/sandboxd.Dockerfile -t rhema-sandboxd .

docker run -d --name sandboxd \
  -p 7600:7600 \
  -v sandboxd-base:/var/lib/rhema-sandboxd \
  rhema-sandboxd --port 7600 --token "$(openssl rand -hex 32)"

--token has no environment default: the runner passes the shared secret on the command line; clients send it in x-rhema-token.
--port must be passed — the binary's default is 0 (OS-picked), which a published mapping cannot follow. The image binds 0.0.0.0 (the binary's own default is loopback; overriding the host means overriding the entrypoint).
The base (-v) holds one directory per session name; mount a volume or bind mount there, or every session dies with the container.

A client reaches it with HttpSandbox (feature client): the base URL is http://<host>:<port>, and the session name is the first path segment of every route — POST {base}/{session}/exec|/put|/get|/seed, plus GET /healthz at the root, token required there too.