Lemonfiber
← The board

F11 Executing contributed code

Area
F — Extensibility
Audience
operator
Kind
feature
Status
draft
Maturity
planned
Labels
extensibility, security, verification
Requires
F3
Relates to
F4F5F6F8F10C1G8

The feature in the specification · Read at

Requirements

  1. F11-R1draftMUST

    This feature MUST NOT be implemented while F3-R6 stands, and retiring F3-R6 MUST be a superseding decision record that states what changed, never an edit to the requirement in place.

    locked by
    no version locks it yet
  2. F11-R2draftMUST

    A proposal MUST answer both objections already recorded — that a sandbox confines computation while the risk is I/O, and that an opaque artefact forecloses the readable review F3-R10 asks for — rather than asserting that the sandbox is strong.

    locked by
    no version locks it yet
  3. F11-R3draftMUST

    A proposal MUST name the cases recipes and named adapters genuinely cannot express, with an example of each, and MUST NOT rest on the possibility that such cases exist.

    locked by
    no version locks it yet
  4. F11-R4draftMUST

    Contributed code, if it is ever executed, MUST NOT hold lemonfiber's own authority on the machine: the credential store, the container runtime's socket and the data root MUST be unreachable from it by construction rather than by policy.

    locked by
    no version locks it yet
  5. F11-R5draftMUST

    What contributed code may reach MUST be stated in advance and checkable without running it, and a reach beyond what was stated MUST be refused rather than logged.

    locked by
    no version locks it yet
  6. F11-R6draftMUST

    An operator MUST be able to tell from an installed plugin whether any part of it executes in lemonfiber's process, without reading its source.

    locked by
    no version locks it yet
  7. F11-R7draftMUST

    Where the confinement a proposal depends on cannot be enforced on a supported platform, the code MUST be refused there and reported as refused — never run unconfined, and never reported as run.

    locked by
    no version locks it yet
  8. F11-R8draftMUST

    Contributed code that cannot be loaded or run MUST be reported as unrun and MUST NOT be reported as passed, satisfied, or by being omitted.

    locked by
    no version locks it yet
  9. F11-R9draftMUST

    Nothing this feature introduces may widen what a plugin's container may reach (F3-R24), and a proposal MUST say so explicitly rather than leaving it inferred.

    locked by
    no version locks it yet
  10. F11-R10draftMUST

    Contributed code MUST NOT be able to register itself over a bundled check, remedy or command; F4-R17 holds whatever the mechanism.

    locked by
    no version locks it yet