Tim Bart pims

Sandboxing a Go program in macOS

This sample Go file shows how to use sandbox_init on macOS (now deprecated, but it still works) to prevent a Go application from accessing the network beyond localhost.

	<!doctype html>
	<html lang="en">
	<head>
	<meta charset="UTF-8" />
	<meta name="viewport" content="width=device-width, initial-scale=1" />
	<title>Semantic Search Demo</title>
	<link
	href="https://cdn.jsdelivr.net/npm/[email protected]/dist/tailwind.min.css"
	rel="stylesheet"
	/>

	#!/usr/bin/env bash

	# Inspired from:
	# - https://blog.wesleyac.com/posts/simple-deploy-script
	# - https://gist.github.com/WesleyAC/b3aaa0292579158ad566c140415c875d
	# - https://caddyserver.com/docs/running#using-the-service

	set -e
	# cd $(dirname $0)

	// functions/index.js
	export async function onRequestGet({ request, env }) {
	// Start getting something from "the DB"
	const dbPromise = scheduler.wait(1000).then(() => new Date().toDateString());

	// Fetch index.html from cache (body will stream below)
	const staticShell = await env.ASSETS.fetch(request);

	// The browser will immediately render up until the body closing tag,
	// then we insert dom modification scripts as the data is resolved

	#!/usr/bin/env bash

	# Abort sign off on any error
	set -e

	# Start the benchmark timer
	SECONDS=0

	# Repository introspection
	OWNER=$(gh repo view --json owner --jq .owner.login)

	library(tidyverse)

	n_games <- 100

	# Define the teams
	teams <- c("rock", "paper", "scissors")
	# simulated home advantage #
	home_adv<-2

	# Generate the data frame

	data "archive_file" "example" {
	output_file_mode = "0666" # before umask
	output_path = "${path.module}/example.zip"
	source_file = "${path.module}/example/index.js"
	type = "zip"
	}

	data "aws_apigatewayv2_apis" "substrate" {
	name = "Substrate"
	protocol_type = "HTTP"

	# Rails production setup via SQLite3 made durable by https://litestream.io/
	# Copy this to Dockerfile on a fresh rails app. Deploy to fly.io or any other container engine.
	#
	# try locally: docker build . -t rails && docker run -p3000:3000 -it rails
	#
	# in production you might want to map /data to somewhere on the host,
	# but you don't have to!
	#
	FROM ruby:3.0.2

	#!/usr/bin/env bash
	set -euo pipefail

	help() {
	cat <<EOF
	vmctl [COMMAND] [ARGS]

	Launch firecracker VMs from configuration templates with networks
	managed by CNI. VM configuration is stored in $VM_CONFIG_DIR
	and network configuration is stored in $NET_CONFIG_DIR