marcoallegretti/WEFT_OS
marcoallegretti/WEFT_OS
1
0
Fork 0
mirror of https://github.com/marcoallegretti/WEFT_OS.git synced 2026-03-27 01:13:09 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
WEFT_OS/crates/weft-runtime/Cargo.toml

25 lines
657 B
TOML
Raw Normal View History

feat(runtime): add weft-runtime crate skeleton New crate: weft-runtime — the child process spawned by weft-appd to execute WEFT application packages. src/main.rs: - Parses CLI arguments: <app_id> <session_id> (as per the supervisor contract in runtime.rs). - resolve_package(): searches user store (~/.local/share/weft/apps/<app_id>) then system store (/usr/share/weft/apps/<app_id>) for a wapp.toml manifest. Overridden by WEFT_APP_STORE env var. - Verifies app.wasm exists in the resolved package directory. - Stubs Wasmtime execution with a TODO comment; prints 'READY' to stdout and exits cleanly so weft-appd's supervisor can complete the session lifecycle during development and integration testing. Tests (2): - package_store_roots_includes_system_path: system store path present. - package_store_roots_uses_weft_app_store_when_set: WEFT_APP_STORE override replaces default search list. Also: - Added weft-runtime to workspace Cargo.toml members. - wsl-test.sh: added cargo test -p weft-runtime.
2026-03-11 08:27:30 +00:00
[package]
name = "weft-runtime"
version.workspace = true
edition.workspace = true
rust-version.workspace = true
[[bin]]
name = "weft-runtime"
path = "src/main.rs"
feat(runtime): add wasmtime-runtime feature gate for real Wasm execution Cargo.toml: - New feature: wasmtime-runtime = [dep:wasmtime, dep:wasmtime-wasi] - Default is off so the normal build remains lightweight. - wasmtime 30 and wasmtime-wasi 30 added as optional dependencies. src/main.rs: - run_module(wasm_path) replaces the inline stub. - cfg(not(feature = wasmtime-runtime)): prints READY and returns. Preserves all existing test and development behaviour unchanged. - cfg(feature = wasmtime-runtime): creates a Wasmtime Engine + Module, builds a WASI linker with inherited stdout/stderr, prints READY, then instantiates the module and calls _start. READY is printed before _start so weft-appd can record the session as Running before the app enters its event loop. The production service binary is built with: cargo build -p weft-runtime --release --features wasmtime-runtime
2026-03-11 09:26:41 +00:00
[features]
default = []
feat(runtime): add --preopen and --ipc-socket CLI arguments weft-runtime now parses optional flags after <app_id> <session_id>: --preopen HOST::GUEST pre-opens a host directory at GUEST path in the WASI filesystem (HOST::GUEST or HOST for same path) --ipc-socket PATH sets WEFT_IPC_SOCKET env var inside the component wasmtime-runtime path applies preopened dirs via cap_std and WasiCtxBuilder, and injects WEFT_IPC_SOCKET when --ipc-socket is present. Stub path ignores both flags. weft-appd: SessionRegistry gains ipc_socket field (set to the appd Unix socket path in run()), extracted alongside compositor_tx in dispatch(), and forwarded to supervise() as ipc_socket_path. supervise() passes --ipc-socket <path> to the spawned runtime when present. cap-std added as optional dep under wasmtime-runtime feature.
2026-03-11 14:10:11 +00:00
wasmtime-runtime = ["dep:wasmtime", "dep:wasmtime-wasi", "dep:cap-std"]
feat(runtime): seccomp blocklist filter via optional seccomp feature Add seccomp feature flag (seccompiler + libc, Linux-only, optional). When compiled with --features seccomp, weft-runtime installs a SECCOMP_MODE_FILTER immediately after argument parsing, before any package resolution or WASM execution. Filter strategy: default-allow with explicit KillProcess rules for high-risk syscalls a WASM runtime process has no legitimate need for: ptrace, process_vm_readv/writev, kexec_load, personality, syslog, reboot, mount/umount2, setuid/setgid/setreuid/setregid/setresuid/ setresgid, chroot, pivot_root, init_module/finit_module/delete_module, bpf, perf_event_open, acct. The feature is off by default so the standard build and tests are unaffected. Enable in production service builds with --features seccomp.
2026-03-11 14:34:21 +00:00
seccomp = ["dep:seccompiler", "dep:libc"]
feat(runtime): add wasmtime-runtime feature gate for real Wasm execution Cargo.toml: - New feature: wasmtime-runtime = [dep:wasmtime, dep:wasmtime-wasi] - Default is off so the normal build remains lightweight. - wasmtime 30 and wasmtime-wasi 30 added as optional dependencies. src/main.rs: - run_module(wasm_path) replaces the inline stub. - cfg(not(feature = wasmtime-runtime)): prints READY and returns. Preserves all existing test and development behaviour unchanged. - cfg(feature = wasmtime-runtime): creates a Wasmtime Engine + Module, builds a WASI linker with inherited stdout/stderr, prints READY, then instantiates the module and calls _start. READY is printed before _start so weft-appd can record the session as Running before the app enters its event loop. The production service binary is built with: cargo build -p weft-runtime --release --features wasmtime-runtime
2026-03-11 09:26:41 +00:00
feat(runtime): add weft-runtime crate skeleton New crate: weft-runtime — the child process spawned by weft-appd to execute WEFT application packages. src/main.rs: - Parses CLI arguments: <app_id> <session_id> (as per the supervisor contract in runtime.rs). - resolve_package(): searches user store (~/.local/share/weft/apps/<app_id>) then system store (/usr/share/weft/apps/<app_id>) for a wapp.toml manifest. Overridden by WEFT_APP_STORE env var. - Verifies app.wasm exists in the resolved package directory. - Stubs Wasmtime execution with a TODO comment; prints 'READY' to stdout and exits cleanly so weft-appd's supervisor can complete the session lifecycle during development and integration testing. Tests (2): - package_store_roots_includes_system_path: system store path present. - package_store_roots_uses_weft_app_store_when_set: WEFT_APP_STORE override replaces default search list. Also: - Added weft-runtime to workspace Cargo.toml members. - wsl-test.sh: added cargo test -p weft-runtime.
2026-03-11 08:27:30 +00:00
[dependencies]
anyhow = "1.0"
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
feat(runtime): add wasmtime-runtime feature gate for real Wasm execution Cargo.toml: - New feature: wasmtime-runtime = [dep:wasmtime, dep:wasmtime-wasi] - Default is off so the normal build remains lightweight. - wasmtime 30 and wasmtime-wasi 30 added as optional dependencies. src/main.rs: - run_module(wasm_path) replaces the inline stub. - cfg(not(feature = wasmtime-runtime)): prints READY and returns. Preserves all existing test and development behaviour unchanged. - cfg(feature = wasmtime-runtime): creates a Wasmtime Engine + Module, builds a WASI linker with inherited stdout/stderr, prints READY, then instantiates the module and calls _start. READY is printed before _start so weft-appd can record the session as Running before the app enters its event loop. The production service binary is built with: cargo build -p weft-runtime --release --features wasmtime-runtime
2026-03-11 09:26:41 +00:00
wasmtime = { version = "30", optional = true }
wasmtime-wasi = { version = "30", optional = true }
feat(runtime): add --preopen and --ipc-socket CLI arguments weft-runtime now parses optional flags after <app_id> <session_id>: --preopen HOST::GUEST pre-opens a host directory at GUEST path in the WASI filesystem (HOST::GUEST or HOST for same path) --ipc-socket PATH sets WEFT_IPC_SOCKET env var inside the component wasmtime-runtime path applies preopened dirs via cap_std and WasiCtxBuilder, and injects WEFT_IPC_SOCKET when --ipc-socket is present. Stub path ignores both flags. weft-appd: SessionRegistry gains ipc_socket field (set to the appd Unix socket path in run()), extracted alongside compositor_tx in dispatch(), and forwarded to supervise() as ipc_socket_path. supervise() passes --ipc-socket <path> to the spawned runtime when present. cap-std added as optional dep under wasmtime-runtime feature.
2026-03-11 14:10:11 +00:00
cap-std = { version = "3", optional = true }
feat(runtime): seccomp blocklist filter via optional seccomp feature Add seccomp feature flag (seccompiler + libc, Linux-only, optional). When compiled with --features seccomp, weft-runtime installs a SECCOMP_MODE_FILTER immediately after argument parsing, before any package resolution or WASM execution. Filter strategy: default-allow with explicit KillProcess rules for high-risk syscalls a WASM runtime process has no legitimate need for: ptrace, process_vm_readv/writev, kexec_load, personality, syslog, reboot, mount/umount2, setuid/setgid/setreuid/setregid/setresuid/ setresgid, chroot, pivot_root, init_module/finit_module/delete_module, bpf, perf_event_open, acct. The feature is off by default so the standard build and tests are unaffected. Enable in production service builds with --features seccomp.
2026-03-11 14:34:21 +00:00
seccompiler = { version = "0.4", optional = true }
libc = { version = "0.2", optional = true }
Reference in a new issue Copy permalink