mirror of
https://github.com/langgenius/dify.git
synced 2026-07-27 23:18:33 +08:00
80 lines
2.3 KiB
Markdown
80 lines
2.3 KiB
Markdown
# dify-agent-runtime
|
|
|
|
Go implementation of the shellctl server and runtime utilities.
|
|
|
|
## Architecture
|
|
|
|
```
|
|
cmd/
|
|
shellctl/ - main server binary (shellctl serve)
|
|
sanitize-pty/ - tmux pipe-pane PTY sanitizer (stdin→stdout filter)
|
|
runner-exit/ - post-drain SQLite exit recorder
|
|
dify-agent-cli/ - cli tool talking to agent backend
|
|
runner/ - process runner to bootstrap agent commands
|
|
internal/ - internal implementations
|
|
```
|
|
|
|
## Building
|
|
|
|
```bash
|
|
make build
|
|
```
|
|
|
|
Produces binaries in `bin/`:
|
|
|
|
### Building docker image
|
|
|
|
```
|
|
docker build -f dify-agent-runtime/docker/Dockerfile \
|
|
--build-context agent=./dify-agent \
|
|
-t dify-agent-runtime:latest \
|
|
dify-agent-runtime/
|
|
```
|
|
|
|
### Running docker container
|
|
|
|
```
|
|
docker run -d --name dify-agent-runtime \
|
|
-p 15004:5004 \
|
|
dify-agent-runtime:latest
|
|
```
|
|
|
|
## Help text generation
|
|
|
|
Cli help can be generated and injected to dify-agent's system prompt.
|
|
|
|
```sh
|
|
make gen-cli-help
|
|
```
|
|
|
|
## Testing
|
|
|
|
```bash
|
|
make test
|
|
```
|
|
|
|
## Path Isolation
|
|
|
|
Each agent job runs inside a Landlock sandbox that restricts filesystem access:
|
|
|
|
| Access | Paths (defaults) |
|
|
| -------------------- | ------------------------------------------------------------------------------------------------------------- |
|
|
| **Read-Write** | `$HOME` (always, includes `$CWD/.tmp` as `TMPDIR`) |
|
|
| **Read-Write (dev)** | `/dev/null`, `/dev/zero`, `/dev/urandom`, `/dev/random`, `/dev/tty` |
|
|
| **Read-Only + Exec** | `/usr`, `/bin`, `/sbin`, `/lib`, `/lib64`, `/etc`, `/proc`, `/opt/dify-agent-tools`, `/opt/homebrew`, `/snap` |
|
|
| **Denied** | Everything else (`/tmp`, other agents' homes, `/var`, `/srv`, etc.) |
|
|
|
|
The runner automatically creates `$CWD/.tmp` and sets `TMPDIR`, `TMP`, `TEMP` to it, so temp files stay isolated per workspace.
|
|
|
|
### Environment Variables
|
|
|
|
See [here](./internal/envvar/envvar.go)
|
|
|
|
Requires Linux ≥ 5.13. On unsupported kernels, a warning is printed to stderr.
|
|
|
|
## Dependencies
|
|
|
|
- Go 1.26
|
|
- `modernc.org/sqlite` (pure-Go SQLite driver, no CGO required)
|
|
- tmux (runtime dependency, not a build dependency)
|