stalwart_agents.sandbox
The sandbox a compute step's function runs in, on the customer's host: the launcher
(launch), the seccomp profile beside it, and the image it starts.
The image is Stalwart's own qls-sandbox, published with each release of this
package under the release's version (image()), on every tier: the licence names it
among what it carries, and nothing on Stalwart's servers runs it. A checkout's
version names no published image, so a checkout runs the qls-sandbox image built
from the repository (docker build -t qls-sandbox service/sandbox).
QLS_SANDBOX_IMAGE names another reference -- a mirror, or an image pinned by
digest -- and QLS_SANDBOX_DOCKER the docker CLI, as the launcher reads them.
python -m stalwart_agents.sandbox fetches the image this release runs, once
Where each release's sandbox image is published.
The sandbox image a compute step starts: QLS_SANDBOX_IMAGE, else this release's published
image, else -- in a checkout, whose version names none -- the one built from the repository.
Returns: An image reference the docker CLI takes.
Example:
image() in (os.environ.get("QLS_SANDBOX_IMAGE"), "qls-sandbox", f"{REGISTRY_IMAGE}:{__version__}") True