burstdecentraapp

Independent component of Burst Kit. See the workspace plans for V1 architecture.

Module path burstkit.dev/burstdecentraapp is provisional until repository ownership is selected. Run go test ./... from this directory.

Workload admission validates required limits and scoped grants. Worker adds a bounded offline execution backend using a trusted Linux Docker daemon with gVisor's runsc runtime. There is no fallback to an ordinary runtime.

The worker requires CPU, memory/swap and PID limit support; immutable local image IDs or repository digests; no image-defined volumes; a read-only root; non-root UID; no network; dropped capabilities; and no-new-privileges. It bounds output, execution time and concurrency, checks current host-provided authorization before launch and every second, and attempts forced cleanup on every outcome. Cleanup failures return the container name and cleanup_pending for supervisor retry. The daemon and its runtime configuration are part of the trusted operator boundary.

burstworker is a local operator CLI for stateless jobs, with explicit network and space scope. It runs the image's entrypoint; Go/Node/Python runtimes are provided by their images. It cannot issue credentials or access Burst objects; nonempty data grants are rejected. The control API does not yet schedule jobs. Distributed scheduling, durable reconciliation after supervisor crashes, service identities and a policy-aware data broker remain outstanding.

dist/burstworker -check
dist/burstworker -network devnet -space SPACE -manifest workload.json
sh scripts/test-worker.sh

Manifest fields currently use exported Go names; Timeout is integer nanoseconds:

{"NetworkID":"devnet","SpaceID":"SPACE","ApplicationID":"demo","ServiceID":"demo","Runtime":"go","Image":"sha256:REPLACE_WITH_64_HEX_IMAGE_ID","MemoryBytes":67108864,"CPUQuotaMillis":500,"Timeout":30000000000,"ReadOnlyRoot":true,"DenyNetworkEgress":true}

Unit tests cover lifecycle failure, denial, capacity, output bounds and cleanup using a test-only fake Docker executable. The separate live test builds a scratch probe image and checks non-root identity, denied root writes and denied external network access. Docker access is unavailable in the current development sandbox; passing unit tests do not establish actual runtime isolation.

Runtime references: gVisor Docker setup and Docker create options.