tdsk-sandbox

Call createSandboxProvider(type) with a TSandboxType value to get a LocalSandboxProvider or KubeSandboxProvider instance. The factory is map-based and extensible via providers.set() for custom implementations of ISandboxProvider.

The local provider uses a just-bash virtual shell, in-memory filesystem, optional V8 isolate, and virtual git. The Kubernetes provider connects to existing pods via the K8s Exec API over WebSocket, never using child_process.

Yes, the local provider degrades gracefully when isolated-vm is unavailable. Shell, filesystem, and git operations still function; only V8 isolate-based code evaluation is affected.

Use IsolateRunner's evaluate(code, timeout) method, which lazily initializes the isolate and enforces a memory limit and timer clamp. It provides 14 Node.js shims including fs, path, buffer, and crypto, and process.exit() throws instead of exiting.

The cycleListen method restarts the watch every 10 minutes to work around Kubernetes bug #596, where long-lived watch connections silently stop delivering events. Pod events are wired to hydration via setupKubeWatcher.