strata

> Lightweight Session Sandbox — Isolated Shell via Namespace + Overlayfs

中文版

• Lightweight: Linux Namespace + bubblewrap + fuse-overlayfs
• Isolated: Per-user + per-session with writable overlay layer
• Multi-Protocol: HTTP REST / WebSocket / gRPC / MCP
• Persistent: overlayfs layering, changes don't affect base
• Auto Cleanup: TTL-based session cleanup

┌─────────────────────────────────────────────┐
│  API Layer (HTTP/WS + gRPC + MCP)           │
└─────────────────┬───────────────────────────┘
                  │
┌─────────────────▼───────────────────────────┐
│  Session Manager                            │
│  - GetOrCreate(user, session)               │
│  - TTL cleanup                              │
└─────────────────┬───────────────────────────┘
                  │
┌─────────────────▼───────────────────────────┐
│  Isolation Layer                            │
│  bwrap + overlayfs (fuse-overlayfs)         │
│  ├── PID/IPC/UTS Namespace                  │
│  ├── overlay: lower + upper + merged        │
│  └── PTY (pseudo-terminal)                  │
└─────────────────────────────────────────────┘

# Check dependencies
./scripts/check-env.sh

# Build
make build

# Run
./dist/strata

# Create session
curl -X POST http://localhost:2280/api/sessions \
  -H "Content-Type: application/json" \
  -d '{"user_id": "alice", "session_id": "task-001"}'

# Execute command
curl -X POST http://localhost:2280/api/sessions/alice/task-001/exec \
  -H "Content-Type: application/json" \
  -d '{"command": "ls -la"}'

# Interactive shell (WebSocket)
wscat -c 'ws://localhost:2280/api/ws/alice/task-001/shell'

| Method | Path | Description | |--------|------|-------------| | POST | /api/sessions | Create session | | DELETE | /api/sessions/{uid}/{sid} | Close session | | POST | /api/sessions/{uid}/{sid}/exec | Execute command | | GET | `/a