Skip to content

runtimes

View on pkg.go.dev

import "github.com/thesimonho/warden/runtimes"

Package runtimes defines the language runtime registry for Warden containers.

Each runtime declares what gets installed, which network domains it needs (for restricted network mode), which environment variables it sets (for cache persistence), and which marker files indicate a project uses it.

The package has no internal dependencies — it is importable by any consumer.

func AllIDs() []string

AllIDs returns the IDs of all registered runtimes in registry order.

func AlwaysEnabledIDs() []string

AlwaysEnabledIDs returns the IDs of runtimes that are always enabled (e.g. Node.js for MCP servers). Used as a fallback when no runtimes are explicitly configured.

func Detect(projectPath string) map[string]bool

Detect scans the project root directory for marker files and returns a map of runtime ID to detected status. Only performs a shallow scan (no recursion). Always-enabled runtimes are always marked as detected.

func DomainsByRuntime(ids []string) map[string][]string

DomainsByRuntime returns a map of runtime ID to its network domains, for all runtimes in the given list. Useful for displaying which runtime contributed which domains.

func DomainsForRuntimes(ids []string) []string

DomainsForRuntimes collects and deduplicates all network domains required by the given runtime IDs.

func EnvVarsForRuntimes(ids []string) map[string]string

EnvVarsForRuntimes collects all environment variables for the given runtime IDs. Later runtimes override earlier ones if keys conflict.

func FilterUserDomains(allDomains []string, runtimeIDs []string) []string

FilterUserDomains removes any domains that are contributed by the given runtimes from the domain list, returning only user-specified domains.

func IsValidID(id string) bool

IsValidID reports whether the given string is a registered runtime ID.

func SystemDomains() []string

SystemDomains returns network domains required for agent CLI installation, independent of user-selected runtimes. These are always merged into the allowed domain list for restricted-mode containers so downloads succeed even when iptables are active.

Currently: storage.googleapis.com (Claude Code binary on GCS). Node.js registry (for Codex npm install) is already covered by the always-enabled Node runtime.

Runtime describes a language runtime that can be installed in a container.

type Runtime struct {
// ID is the unique identifier (e.g. "node", "python", "go").
ID string
// Label is the human-readable name (e.g. "Node.js", "Python", "Go").
Label string
// Description briefly explains what gets installed.
Description string
// AlwaysEnabled means this runtime cannot be deselected (e.g. Node for MCP).
AlwaysEnabled bool
// Domains lists network domains required for this runtime's package registry.
Domains []string
// EnvVars maps environment variable names to values set when this runtime
// is enabled. These point caches to the shared volume for persistence.
EnvVars map[string]string
// MarkerFiles lists filenames whose presence in the project root indicates
// the project uses this runtime.
MarkerFiles []string
}

func ByID(id string) *Runtime

ByID returns a runtime by its identifier, or nil if not found.

func Registry() []Runtime

Registry returns the full ordered list of available runtimes.

Generated by gomarkdoc