refactor: rename sandbox working directory from /code to /sandbox

koki-develop · claude · koki-develop · commit fdff04acdbc7 · 2026-03-06T18:21:41.000+09:00
Co-Authored-By: Claude &lt;noreply@anthropic.com&gt;
diff --git a/e2e/tests/runtime/node.yml b/e2e/tests/runtime/node.yml
@@ -261,8 +261,8 @@ tests:
           body:
             run:
               stdout: ""
-              stderr: "/^/code/index\\.js:1\nthrow new Error\\(\"something went wrong\"\\);\n\\^\n\nError: something went wrong\n    at Object\\.<anonymous> \\(/code/index\\.js:1:7\\)\n[\\s\\S]*Node\\.js v[\\d.]+\n$/"
-              output: "/^/code/index\\.js:1\nthrow new Error\\(\"something went wrong\"\\);\n\\^\n\nError: something went wrong\n    at Object\\.<anonymous> \\(/code/index\\.js:1:7\\)\n[\\s\\S]*Node\\.js v[\\d.]+\n$/"
+              stderr: "/^/sandbox/index\\.js:1\nthrow new Error\\(\"something went wrong\"\\);\n\\^\n\nError: something went wrong\n    at Object\\.<anonymous> \\(/sandbox/index\\.js:1:7\\)\n[\\s\\S]*Node\\.js v[\\d.]+\n$/"
+              output: "/^/sandbox/index\\.js:1\nthrow new Error\\(\"something went wrong\"\\);\n\\^\n\nError: something went wrong\n    at Object\\.<anonymous> \\(/sandbox/index\\.js:1:7\\)\n[\\s\\S]*Node\\.js v[\\d.]+\n$/"
               exit_code: 1
               status: "OK"
               signal: null
diff --git a/e2e/tests/runtime/ruby.yml b/e2e/tests/runtime/ruby.yml
@@ -254,8 +254,8 @@ tests:
           body:
             run:
               stdout: ""
-              stderr: "/code/main.rb:1:in '<main>': something went wrong (RuntimeError)\n"
-              output: "/code/main.rb:1:in '<main>': something went wrong (RuntimeError)\n"
+              stderr: "/sandbox/main.rb:1:in '<main>': something went wrong (RuntimeError)\n"
+              output: "/sandbox/main.rb:1:in '<main>': something went wrong (RuntimeError)\n"
               exit_code: 1
               status: "OK"
               signal: null
diff --git a/e2e/tests/security/bind_mount_flags.yml b/e2e/tests/security/bind_mount_flags.yml
@@ -80,15 +80,15 @@ tests:
               status: "OK"
               signal: null
 
-  - name: "/code bind mount has nosuid and nodev flags"
+  - name: "/sandbox bind mount has nosuid and nodev flags"
     requests:
       - input:
           runtime: bash
           files:
             - name: main.sh
               type: plain
               content: |
-                grep ' /code ' /proc/mounts | tr ' ' '\n' | sed -n '4p' | tr ',' '\n' | grep -E '^(nosuid|nodev)$' | sort
+                grep ' /sandbox ' /proc/mounts | tr ' ' '\n' | sed -n '4p' | tr ',' '\n' | grep -E '^(nosuid|nodev)$' | sort
         output:
           status: 200
           body:
diff --git a/e2e/tests/security/filesystem.yml b/e2e/tests/security/filesystem.yml
@@ -61,8 +61,8 @@ tests:
           body:
             run:
               stdout: ""
-              stderr: "/code/main.sh: line 1: /lib/test: Read-only file system\n"
-              output: "/code/main.sh: line 1: /lib/test: Read-only file system\n"
+              stderr: "/sandbox/main.sh: line 1: /lib/test: Read-only file system\n"
+              output: "/sandbox/main.sh: line 1: /lib/test: Read-only file system\n"
               exit_code: 1
               status: "OK"
               signal: null
@@ -81,8 +81,8 @@ tests:
           body:
             run:
               stdout: ""
-              stderr: "/code/main.sh: line 1: /usr/bin/test: Read-only file system\n"
-              output: "/code/main.sh: line 1: /usr/bin/test: Read-only file system\n"
+              stderr: "/sandbox/main.sh: line 1: /usr/bin/test: Read-only file system\n"
+              output: "/sandbox/main.sh: line 1: /usr/bin/test: Read-only file system\n"
               exit_code: 1
               status: "OK"
               signal: null
@@ -102,8 +102,8 @@ tests:
           body:
             run:
               stdout: ""
-              stderr: "/code/main.sh: line 1: /lib64/test: Read-only file system\n"
-              output: "/code/main.sh: line 1: /lib64/test: Read-only file system\n"
+              stderr: "/sandbox/main.sh: line 1: /lib64/test: Read-only file system\n"
+              output: "/sandbox/main.sh: line 1: /lib64/test: Read-only file system\n"
               exit_code: 1
               status: "OK"
               signal: null
@@ -123,8 +123,8 @@ tests:
           body:
             run:
               stdout: ""
-              stderr: "/code/main.sh: line 1: /lib64/test: Not a directory\n"
-              output: "/code/main.sh: line 1: /lib64/test: Not a directory\n"
+              stderr: "/sandbox/main.sh: line 1: /lib64/test: Not a directory\n"
+              output: "/sandbox/main.sh: line 1: /lib64/test: Not a directory\n"
               exit_code: 1
               status: "OK"
               signal: null
@@ -191,8 +191,8 @@ tests:
           body:
             run:
               stdout: ""
-              stderr: "/code/main.sh: line 1: /proc/self/oom_score_adj: Read-only file system\n"
-              output: "/code/main.sh: line 1: /proc/self/oom_score_adj: Read-only file system\n"
+              stderr: "/sandbox/main.sh: line 1: /proc/self/oom_score_adj: Read-only file system\n"
+              output: "/sandbox/main.sh: line 1: /proc/self/oom_score_adj: Read-only file system\n"
               exit_code: 1
               status: "OK"
               signal: null
@@ -232,8 +232,8 @@ tests:
           body:
             run:
               stdout: ""
-              stderr: "/^/code/main\\.rb:\\d+:.*Read-only file system @ rb_sysopen - /mise/installs/ruby/[\\d.]+/test \\(Errno::EROFS\\)\\n\\tfrom /code/main\\.rb:\\d+:.*\\n$/"
-              output: "/^/code/main\\.rb:\\d+:.*Read-only file system @ rb_sysopen - /mise/installs/ruby/[\\d.]+/test \\(Errno::EROFS\\)\\n\\tfrom /code/main\\.rb:\\d+:.*\\n$/"
+              stderr: "/^/sandbox/main\\.rb:\\d+:.*Read-only file system @ rb_sysopen - /mise/installs/ruby/[\\d.]+/test \\(Errno::EROFS\\)\\n\\tfrom /sandbox/main\\.rb:\\d+:.*\\n$/"
+              output: "/^/sandbox/main\\.rb:\\d+:.*Read-only file system @ rb_sysopen - /mise/installs/ruby/[\\d.]+/test \\(Errno::EROFS\\)\\n\\tfrom /sandbox/main\\.rb:\\d+:.*\\n$/"
               exit_code: 1
               status: "OK"
               signal: null
diff --git a/e2e/tests/security/filesystem_advanced.yml b/e2e/tests/security/filesystem_advanced.yml
@@ -19,37 +19,37 @@ tests:
               status: "OK"
               signal: null
 
-  - name: "device node creation in /code is blocked (no CAP_MKNOD)"
+  - name: "device node creation in /sandbox is blocked (no CAP_MKNOD)"
     requests:
       - input:
           runtime: bash
           files:
             - name: main.sh
               type: plain
               content: |
-                mknod /code/urandom c 1 9
+                mknod /sandbox/urandom c 1 9
         output:
           status: 200
           body:
             run:
               stdout: ""
-              stderr: "mknod: /code/urandom: Operation not permitted\n"
-              output: "mknod: /code/urandom: Operation not permitted\n"
+              stderr: "mknod: /sandbox/urandom: Operation not permitted\n"
+              output: "mknod: /sandbox/urandom: Operation not permitted\n"
               exit_code: 1
               status: "OK"
               signal: null
 
-  - name: "SUID bit set in /code does not grant elevated privileges"
+  - name: "SUID bit set in /sandbox does not grant elevated privileges"
     requests:
       - input:
           runtime: bash
           files:
             - name: main.sh
               type: plain
               content: |
-                cp /usr/bin/id /code/suid-id
-                chmod 4755 /code/suid-id 2>/dev/null
-                /code/suid-id
+                cp /usr/bin/id /sandbox/suid-id
+                chmod 4755 /sandbox/suid-id 2>/dev/null
+                /sandbox/suid-id
         output:
           status: 200
           body:
@@ -69,14 +69,14 @@ tests:
             - name: main.sh
               type: plain
               content: |
-                echo test > /tmp/srcfile && ln /tmp/srcfile /code/crosslink
+                echo test > /tmp/srcfile && ln /tmp/srcfile /sandbox/crosslink
         output:
           status: 200
           body:
             run:
               stdout: ""
-              stderr: "ln: failed to create hard link '/code/crosslink' => '/tmp/srcfile': Invalid cross-device link\n"
-              output: "ln: failed to create hard link '/code/crosslink' => '/tmp/srcfile': Invalid cross-device link\n"
+              stderr: "ln: failed to create hard link '/sandbox/crosslink' => '/tmp/srcfile': Invalid cross-device link\n"
+              output: "ln: failed to create hard link '/sandbox/crosslink' => '/tmp/srcfile': Invalid cross-device link\n"
               exit_code: 1
               status: "OK"
               signal: null
diff --git a/e2e/tests/security/network_advanced.yml b/e2e/tests/security/network_advanced.yml
@@ -14,8 +14,8 @@ tests:
           body:
             run:
               stdout: ""
-              stderr: "/code/main.rb:2:in 'Socket#initialize': Operation not permitted - socket(2) (Errno::EPERM)\n\tfrom /code/main.rb:2:in 'IO.new'\n\tfrom /code/main.rb:2:in '<main>'\n"
-              output: "/code/main.rb:2:in 'Socket#initialize': Operation not permitted - socket(2) (Errno::EPERM)\n\tfrom /code/main.rb:2:in 'IO.new'\n\tfrom /code/main.rb:2:in '<main>'\n"
+              stderr: "/sandbox/main.rb:2:in 'Socket#initialize': Operation not permitted - socket(2) (Errno::EPERM)\n\tfrom /sandbox/main.rb:2:in 'IO.new'\n\tfrom /sandbox/main.rb:2:in '<main>'\n"
+              output: "/sandbox/main.rb:2:in 'Socket#initialize': Operation not permitted - socket(2) (Errno::EPERM)\n\tfrom /sandbox/main.rb:2:in 'IO.new'\n\tfrom /sandbox/main.rb:2:in '<main>'\n"
               exit_code: 1
               status: "OK"
               signal: null
@@ -35,8 +35,8 @@ tests:
           body:
             run:
               stdout: ""
-              stderr: "/code/main.rb:2:in 'UNIXSocket#initialize': No such file or directory - connect(2) for /run/docker.sock (Errno::ENOENT)\n\tfrom /code/main.rb:2:in 'IO.new'\n\tfrom /code/main.rb:2:in '<main>'\n"
-              output: "/code/main.rb:2:in 'UNIXSocket#initialize': No such file or directory - connect(2) for /run/docker.sock (Errno::ENOENT)\n\tfrom /code/main.rb:2:in 'IO.new'\n\tfrom /code/main.rb:2:in '<main>'\n"
+              stderr: "/sandbox/main.rb:2:in 'UNIXSocket#initialize': No such file or directory - connect(2) for /run/docker.sock (Errno::ENOENT)\n\tfrom /sandbox/main.rb:2:in 'IO.new'\n\tfrom /sandbox/main.rb:2:in '<main>'\n"
+              output: "/sandbox/main.rb:2:in 'UNIXSocket#initialize': No such file or directory - connect(2) for /run/docker.sock (Errno::ENOENT)\n\tfrom /sandbox/main.rb:2:in 'IO.new'\n\tfrom /sandbox/main.rb:2:in '<main>'\n"
               exit_code: 1
               status: "OK"
               signal: null
diff --git a/e2e/tests/security/proc.yml b/e2e/tests/security/proc.yml
@@ -13,8 +13,8 @@ tests:
           body:
             run:
               stdout: ""
-              stderr: "/code/main.sh: line 1: /proc/sysrq-trigger: Read-only file system\n"
-              output: "/code/main.sh: line 1: /proc/sysrq-trigger: Read-only file system\n"
+              stderr: "/sandbox/main.sh: line 1: /proc/sysrq-trigger: Read-only file system\n"
+              output: "/sandbox/main.sh: line 1: /proc/sysrq-trigger: Read-only file system\n"
               exit_code: 1
               status: "OK"
               signal: null
@@ -33,8 +33,8 @@ tests:
           body:
             run:
               stdout: ""
-              stderr: "/code/main.sh: line 1: /proc/self/mem: Read-only file system\n"
-              output: "/code/main.sh: line 1: /proc/self/mem: Read-only file system\n"
+              stderr: "/sandbox/main.sh: line 1: /proc/self/mem: Read-only file system\n"
+              output: "/sandbox/main.sh: line 1: /proc/self/mem: Read-only file system\n"
               exit_code: 1
               status: "OK"
               signal: null
@@ -53,8 +53,8 @@ tests:
           body:
             run:
               stdout: ""
-              stderr: "/code/main.sh: line 1: /proc/sys/kernel/randomize_va_space: Read-only file system\n"
-              output: "/code/main.sh: line 1: /proc/sys/kernel/randomize_va_space: Read-only file system\n"
+              stderr: "/sandbox/main.sh: line 1: /proc/sys/kernel/randomize_va_space: Read-only file system\n"
+              output: "/sandbox/main.sh: line 1: /proc/sys/kernel/randomize_va_space: Read-only file system\n"
               exit_code: 1
               status: "OK"
               signal: null
diff --git a/e2e/tests/security/resource_exhaustion.yml b/e2e/tests/security/resource_exhaustion.yml
@@ -45,8 +45,8 @@ tests:
           body:
             run:
               stdout: ""
-              stderr: "/^/code/main\\.sh: line \\d+: echo: write error: No space left on device\n$/"
-              output: "/^/code/main\\.sh: line \\d+: echo: write error: No space left on device\n$/"
+              stderr: "/^/sandbox/main\\.sh: line \\d+: echo: write error: No space left on device\n$/"
+              output: "/^/sandbox/main\\.sh: line \\d+: echo: write error: No space left on device\n$/"
               exit_code: 1
               status: "OK"
               signal: null
diff --git a/e2e/tests/security/rlimit.yml b/e2e/tests/security/rlimit.yml
@@ -183,8 +183,8 @@ tests:
           body:
             run:
               stdout: ""
-              stderr: "/^(/code/main\\.sh: fork: retry: Resource temporarily unavailable\n)+$/"
-              output: "/^(/code/main\\.sh: fork: retry: Resource temporarily unavailable\n)+$/"
+              stderr: "/^(/sandbox/main\\.sh: fork: retry: Resource temporarily unavailable\n)+$/"
+              output: "/^(/sandbox/main\\.sh: fork: retry: Resource temporarily unavailable\n)+$/"
               exit_code: 0
               status: "OK"
               signal: null
diff --git a/e2e/tests/security/tmpfs_mount_flags.yml b/e2e/tests/security/tmpfs_mount_flags.yml
@@ -47,9 +47,9 @@ tests:
             - name: main.sh
               type: plain
               content: |
-                cp /usr/bin/id /code/suid-id
-                chmod 4755 /code/suid-id
-                /code/suid-id
+                cp /usr/bin/id /sandbox/suid-id
+                chmod 4755 /sandbox/suid-id
+                /sandbox/suid-id
         output:
           status: 200
           body:
@@ -77,8 +77,8 @@ tests:
           body:
             run:
               stdout: ""
-              stderr: "/code/main.sh: line 3: /tmp/test-exec: Permission denied\n"
-              output: "/code/main.sh: line 3: /tmp/test-exec: Permission denied\n"
+              stderr: "/sandbox/main.sh: line 3: /tmp/test-exec: Permission denied\n"
+              output: "/sandbox/main.sh: line 3: /tmp/test-exec: Permission denied\n"
               exit_code: 126
               status: "OK"
               signal: null
diff --git a/internal/sandbox/configs/nsjail.cfg b/internal/sandbox/configs/nsjail.cfg
@@ -17,7 +17,7 @@ seccomp_policy_file: "/etc/nsjail/seccomp.kafel"
 log_fd: 3
 
 # Working directory inside the jail.
-cwd: "/code"
+cwd: "/sandbox"
 
 # Auto-detect cgroup v2 at runtime for cgroup-based limits.
 detect_cgroupv2: true
@@ -187,7 +187,7 @@ mount {
 # process sets to the per-request temporary directory before launching nsjail.
 mount {
     prefix_src_env: "NSJAIL_WORKING_DIR"
-    dst: "/code"
+    dst: "/sandbox"
     is_bind: true
     rw: true
     nosuid: true
@@ -199,7 +199,7 @@ mount {
 # the sandbox. outside_id is omitted, defaulting to "" which resolves to the
 # current process UID/GID (0 when running as root in Docker). The kernel
 # authorizes filesystem operations using outside_id=0, so read-write access
-# to bind-mounted paths (/code, /usr/lib, etc.) is unaffected. Only one UID
+# to bind-mounted paths (/sandbox, /usr/lib, etc.) is unaffected. Only one UID
 # is mapped (count defaults to 1), so setuid() to any other UID fails with
 # EPERM.
 uidmap {
diff --git a/internal/sandbox/runtime.go b/internal/sandbox/runtime.go
@@ -29,7 +29,7 @@ type Runtime interface {
 	Name() RuntimeName
 
 	// Command returns the full command and arguments to execute inside the sandbox.
-	// entryFile is the absolute path inside the sandbox (e.g. "/code/index.js").
+	// entryFile is the absolute path inside the sandbox (e.g. "/sandbox/index.js").
 	// Compiled runtimes may ignore this parameter when the executable path is
 	// determined by the compilation step.
 	Command(entryFile string) []string
@@ -268,7 +268,7 @@ func (goRuntime) Name() RuntimeName { return RuntimeGo }
 // Command returns the path to the compiled binary. The entryFile parameter is
 // unused because the output path is determined by CompileCommand.
 func (goRuntime) Command(_ string) []string {
-	return []string{"/code/main"}
+	return []string{"/sandbox/main"}
 }
 
 // BindMounts returns nil because the compiled binary is statically linked
@@ -282,7 +282,7 @@ func (goRuntime) Env() []string {
 }
 
 func (goRuntime) CompileCommand() []string {
-	return []string{"/mise/installs/go/1.26.0/bin/go", "build", "-o", "/code/main", "."}
+	return []string{"/mise/installs/go/1.26.0/bin/go", "build", "-o", "/sandbox/main", "."}
 }
 
 func (goRuntime) CompileBindMounts() []BindMount {
@@ -368,7 +368,7 @@ func (goRuntime) Limits() Limits {
 // RestrictedFiles prevents users from overriding go.mod and go.sum, which
 // must match the pre-downloaded module cache (GOPROXY=off forbids fetching).
 // "main" is also restricted because go build writes the compiled binary to
-// /code/main, which would silently overwrite a user file with that name.
+// /sandbox/main, which would silently overwrite a user file with that name.
 func (goRuntime) RestrictedFiles() []string {
 	return []string{"go.mod", "go.sum", "main"}
 }
diff --git a/internal/sandbox/sandbox.go b/internal/sandbox/sandbox.go
@@ -57,7 +57,7 @@ type execParams struct {
 	command    []string    // command and arguments to run inside the sandbox
 	bindMounts []BindMount // runtime-specific bind mounts (mounted read-only by buildArgs)
 	env        []string    // environment variables in "KEY=VALUE" format
-	tmpDir     string      // host directory bind-mounted as /code (sandbox working directory)
+	tmpDir     string      // host directory bind-mounted as /sandbox (sandbox working directory)
 	limits     Limits      // nsjail resource limits (rlimits + cgroups)
 	timeout    int         // nsjail --time_limit and --rlimit_cpu value for this invocation, in seconds
 }
@@ -205,7 +205,7 @@ func (r *Runner) Run(ctx context.Context, rt Runtime, tmpDir, entryFile string)
 	}
 
 	result, err := r.exec(ctx, execParams{
-		command:    rt.Command(filepath.Join("/code", entryFile)),
+		command:    rt.Command(filepath.Join("/sandbox", entryFile)),
 		bindMounts: rt.BindMounts(),
 		env:        rt.Env(),
 		tmpDir:     tmpDir,
diff --git a/internal/sandbox/sandbox_test.go b/internal/sandbox/sandbox_test.go
@@ -118,7 +118,7 @@ func TestExecution_buildArgs(t *testing.T) {
 
 	e := &execution{
 		timeout: 10,
-		command: []string{"/usr/bin/node", "/code/index.js"},
+		command: []string{"/usr/bin/node", "/sandbox/index.js"},
 		bindMounts: []BindMount{
 			{Src: "/mise/installs/node/24", Dst: "/mise/installs/node/24"},
 		},
@@ -145,7 +145,7 @@ func TestExecution_buildArgs(t *testing.T) {
 		"--cgroup_cpu_ms_per_sec", "750",
 		"-E", "PATH=/usr/bin:/bin",
 		"--",
-		"/usr/bin/node", "/code/index.js",
+		"/usr/bin/node", "/sandbox/index.js",
 	}
 
 	assert.Equal(t, want, e.buildArgs())
