Rulvar API reference / @rulvar/executor / ContainerExecutorOptions
Interface: ContainerExecutorOptions
Defined in: packages/executor/src/container.ts:68
Properties
| Property | Type | Description | Defined in |
|---|---|---|---|
args? | readonly string[] | Argv prepended before the tool's own args. | packages/executor/src/container.ts:132 |
capDrop? | readonly string[] | Capabilities to drop. Default ['ALL']. | packages/executor/src/container.ts:88 |
command? | string | Fallback command (inside the container) when executorSpec omits one. | packages/executor/src/container.ts:130 |
cpus? | string | --cpus. Default '1.0'. | packages/executor/src/container.ts:82 |
credentials? | (request) => | Record<string, string> | Promise<Record<string, string>> | Mints per-call short-lived credentials, forwarded into the container. | packages/executor/src/container.ts:116 |
daemonEnv? | readonly string[] | Host env names the docker CLI itself may read. Default the daemon set. | packages/executor/src/container.ts:114 |
docker? | string | The docker-compatible CLI. Default 'docker'. | packages/executor/src/container.ts:76 |
extraDockerArgs? | readonly string[] | Extra raw docker run flags, placed BEFORE the hardening flags (RV4915) so a repeated single valued flag (--memory, --pids-limit, --read-only) resolves to the fixed value and a conflicting --network fails the dispatch at the daemon instead of running with it. List valued flags such as --cap-add accumulate whatever the order, which is why the regulated floor refuses any extra flag rather than denylisting some. | packages/executor/src/container.ts:110 |
forwardEnv? | readonly string[] | Host env names forwarded INTO the container (not the daemon env). Default none. | packages/executor/src/container.ts:112 |
image | string | The image the tool runs in (required). A tool whose executorSpec names an image pinned by digest runs in that image instead (RV4915); the regulated floor requires this one to be pinned too. | packages/executor/src/container.ts:74 |
killGraceMs? | number | Grace between SIGTERM and SIGKILL of the docker CLI. Default 5_000. | packages/executor/src/container.ts:122 |
ledger? | ToolEffectLedger | Records every dispatch. | packages/executor/src/container.ts:128 |
maxOutputBytes? | number | Max stdout/stderr bytes captured. Default 1 MiB. | packages/executor/src/container.ts:124 |
memory? | string | --memory. Default '256m'. | packages/executor/src/container.ts:80 |
network? | string | --network. Default 'none' (no network at all). | packages/executor/src/container.ts:78 |
now? | () => number | Injectable clock for the ledger's timing fields (tests). | packages/executor/src/container.ts:134 |
pidsLimit? | number | --pids-limit. Default 128. | packages/executor/src/container.ts:84 |
readOnly? | boolean | --read-only root filesystem. Default true. | packages/executor/src/container.ts:86 |
scratchMount? | string | Where the ephemeral workdir is mounted when the work mount is a worktree (RV4914); the tool program reads the path from RULVAR_SCRATCH. Default '/scratch'. | packages/executor/src/container.ts:100 |
timeoutMs? | number | Hard wall-clock ceiling per call. Default 30_000. | packages/executor/src/container.ts:120 |
workdirBase? | string | Base directory for the per-call ephemeral workdir. Default os.tmpdir(). | packages/executor/src/container.ts:126 |
workMount? | string | Where the work directory is mounted inside the container: the ephemeral workdir, or the acquired worktree when the request carries a cwd (RV4914). Default '/work'. | packages/executor/src/container.ts:94 |