local runs programs on the host as subprocesses: the host’s python3, and
any other program you add to its captures, such as ffmpeg, gcc or a
vendor CLI. A program sees the host’s files and network, not the workspace
mounts; to reach the mounts, give it a FUSE folder.
Nothing confines it; on Linux, Sandlock
does. Python SDK and Node only, and never in the default runtimes.
Installation
Nothing to install.home names the python3 to run. Without it, Mirage
uses MIRAGE_LOCAL_HOME, then the interpreter running Mirage (Python) or
python3 on PATH (Node).
Usage
captures defaults to python3 and python. Add program names, or
@external for every program
Mirage does not have itself. Mirage’s own commands, pipes and redirects stay
in Mirage: ffmpeg -i in.mp4 out.webm | wc -c sends only ffmpeg.
- Python
- TypeScript
- YAML
Connecting the workspace
A local program opens host paths, not the workspace’s. To give it workspace files, expose a mount as a FUSE folder:- Put the folder at the mount’s own path when you can, so a path typed in the shell names the same file in the program.
- Calls into the folder follow mount modes and policies. A folder added in
code with a session,
add_fuse_mount(prefix, mountpoint, session_id)oraddFuseMount(prefix, mountpoint, sessionId), also follows that session’s permissions.
What is wired
python3 is the same Mirage command on every Python runtime: Mirage reads
the script from the workspace and checks it like any file, and local runs
it on the host’s interpreter. Every other program is a plain host program.
Notes
- For
python3,__file__and tracebacks name the script’s workspace path, butsys.path[0]stays the host’s working directory. - A timeout kills the subprocess.