CodeInstances Runs Kept Instances on Demand

CodeInstances 0.8 lets a store run what it keeps. Start it with serve -run, and anyone with the store’s token can have it replay a signed run, or fork one at a step, with codeinstances run, and get back how it went. A kept run works like a function in a function service: the request runs it, nobody sets the program up on a laptop, and every call is answered from the recording. The release post has the details, and binaries are out for Linux, macOS and Windows.

A server that runs commands on request needs tight rules, and this one has them. It runs only instances signed by keys trusted to run, a list kept apart from the keys whose uploads it takes. It runs each instance’s recorded command, from a minimal environment in a fresh folder with a time limit. Answers given at a fork are off unless turned on, and kept forks are opt-in and capped. A run’s whole process group is stopped when it ends.

Two independent reviews went over it before release. The first found that a given answer could make a signed program run arbitrary code, that a run could read the store’s token through /proc, and that the store’s own key could make it a signing oracle. The second found that stopping the store left its runs behind. All of it is fixed and tested, with 118 Go tests passing and a clean race detector run. This was the last item on the project’s plan.