Add implementation of PicoD

cmd/picod/main.go

@@ -0,0 +1,37 @@
+package main
+
+import (
+	"flag"
+	"log"
+	"os"
+
+	"github.com/volcano-sh/agentcube/pkg/picod"
+)
+
+func main() {
+	port := flag.Int("port", 8080, "Port for the PicoD server to listen on")
+	bootstrapKeyFile := flag.String("bootstrap-key", "/etc/picod/public-key.pem", "Path to the bootstrap public key file")
+	workspace := flag.String("workspace", "", "Root directory for file operations (default: current working directory)")
+	flag.Parse()
+
+	// Read bootstrap key from file
+	var bootstrapKey []byte
+	if data, err := os.ReadFile(*bootstrapKeyFile); err == nil {
+		bootstrapKey = data
+	} else {
+		log.Fatalf("Failed to read bootstrap key from %s: %v", *bootstrapKeyFile, err)
+	}
+
+	config := picod.Config{
+		Port:         *port,
+		BootstrapKey: bootstrapKey,
+		Workspace:    *workspace,
+	}
+
+	// Create and start server
+	server := picod.NewServer(config)
+
+	if err := server.Run(); err != nil {
+		log.Fatalf("Failed to start server: %v", err)
+	}
+}

go.mod

@@ -7,6 +7,7 @@ toolchain go1.24.9
 require (
 	github.com/alicebob/miniredis/v2 v2.35.0
 	github.com/gin-gonic/gin v1.10.0
+	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/google/uuid v1.6.0
 	github.com/pkg/sftp v1.13.10
 	github.com/redis/go-redis/v9 v9.17.1
@@ -15,6 +16,7 @@ require (
 	k8s.io/api v0.34.1
 	k8s.io/apimachinery v0.34.1
 	k8s.io/client-go v0.34.1
+	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
 	sigs.k8s.io/agent-sandbox v0.1.0
 	sigs.k8s.io/controller-runtime v0.22.2
 )
@@ -97,7 +99,6 @@ require (
 	k8s.io/apiextensions-apiserver v0.34.1 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
-	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect

go.sum

@@ -85,6 +85,8 @@ github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
 github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
+github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
 github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=

images/picod/Dockerfile

@@ -0,0 +1,30 @@
+# Build stage
+FROM golang:1.24.4 AS builder
+
+# Build arguments for multi-architecture support
+ARG TARGETOS=linux
+ARG TARGETARCH
+
+WORKDIR /app
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -a -installsuffix cgo -o picod ./cmd/picod
+
+# Run stage
+FROM ubuntu:24.04
+
+# Install Python3 to support code execution tasks (Code Interpreter)
+RUN apt-get update && apt-get install -y python3
+
+# Use /root/ as the working directory
+# We run as root to allow 'chattr +i' on the public key file (see pkg/picod/auth.go)
+# and to ensure sufficient permissions for arbitrary code execution within the sandbox.
+WORKDIR /root/
+
+COPY --from=builder /app/picod .
+
+ENTRYPOINT ["./picod"]