Quest: Analysis Sandboxing Priority: P5 Status: open
Wrap each analysis execution in a cgroup (v2) with memory limit, CPU quota, and PID limit. If an analysis exceeds its budget, it is killed cleanly without affecting other services. This is the foundation for safe multi-analysis execution.
_Identify during implementation._
_Identify during implementation._
Investigation findings:
scidex/senate/cgroup_isolation.py (380 lines) is present on main with isolated_run(), CgroupManager, and convenience functions (run_notebook_isolated, run_post_process_isolated, run_tool_isolated). However, it is NOT integrated into forge/runtime.py where analysis subprocesses actually execute via subprocess.run().RESOURCE_LIMITS['default'] has memory_limit_mb=1024 (1GB) and timeout_seconds=300 (5min), but spec says 2GB and 30min (1800s). notebook_execution has 2GB/10min.forge/runtime.py:200 in run_python_script() is where subprocess.run(cmd, ...) is called. This is where isolated_run() should be used instead.RuntimeResult in forge/runtime.py doesn't have a completion_notes field. Resource limit errors (TimeoutExpired) are raised but not captured in a completion_notes field.What remains to be done:
RESOURCE_LIMITS['default'] to 2048MB, 1800s (done below)cgroup_isolation.isolated_run into forge/runtime.py:run_python_script()completion_notes: str field to RuntimeResult and capture timeout/limit errorsscidex/senate/cgroup_isolation.py — fix default limits (simple fix done)forge/runtime.py — replace subprocess.run with isolated_run (architectural change)forge/runtime.py — add completion_notes to RuntimeResult (architectural change)Implementation:
from scidex.senate.cgroup_isolation import isolated_run to forge/runtime.pycompletion_notes: Optional[str] = None field to RuntimeResult dataclass to capture resource kill/timeout details.subprocess.run(cmd, ...) in run_python_script() with isolated_run(cmd, cwd=cwd, env=run_env, timeout_seconds=timeout). The isolated_run function wraps execution with systemd-run --user --scope for cgroup-based memory/CPU/PID limits, with a fallback to plain subprocess+timeout when systemd-run is unavailable.except subprocess.TimeoutExpired handler that sets completion_notes with a clear message explaining the timeout, and sets returncode=-1.Files changed:
forge/runtime.py — integrated isolated_run, added completion_notes fieldmemory_limit_mb, cpu_quota, etc. parameters to run_python_script and wiring them from analysis metadata)