Skip to main content
local runs programs on the host as subprocesses: the host’s python3, and any other program you add to its captures, such as ffmpeg, gcc or a vendor CLI. A program sees the host’s files and network, not the workspace mounts; to reach the mounts, give it a FUSE folder. Nothing confines it; on Linux, Sandlock does. Python SDK and Node only, and never in the default runtimes.

Installation

Nothing to install. home names the python3 to run. Without it, Mirage uses MIRAGE_LOCAL_HOME, then the interpreter running Mirage (Python) or python3 on PATH (Node).

Usage

captures defaults to python3 and python. Add program names, or @external for every program Mirage does not have itself. Mirage’s own commands, pipes and redirects stay in Mirage: ffmpeg -i in.mp4 out.webm | wc -c sends only ffmpeg.

Connecting the workspace

A local program opens host paths, not the workspace’s. To give it workspace files, expose a mount as a FUSE folder:
  • Put the folder at the mount’s own path when you can, so a path typed in the shell names the same file in the program.
  • Calls into the folder follow mount modes and policies. A folder added in code with a session, add_fuse_mount(prefix, mountpoint, session_id) or addFuseMount(prefix, mountpoint, sessionId), also follows that session’s permissions.

What is wired

python3 is the same Mirage command on every Python runtime: Mirage reads the script from the workspace and checks it like any file, and local runs it on the host’s interpreter. Every other program is a plain host program.

Notes

  • For python3, __file__ and tracebacks name the script’s workspace path, but sys.path[0] stays the host’s working directory.
  • A timeout kills the subprocess.