Hidden supervisor CLI verb — the long-running per-container process.
Invoked by the OCI hook chain (via
terok_sandbox.resources.supervisor_wrapper)
rather than directly by operators; the group tag pins it under
the internal section so it doesn't pollute the default --help.
Operators can still call it for debugging — terok-sandbox
supervisor <container-id> <sidecar-path> reads the same sidecar
config the hook chain prepared and composes the same service bundle.
Stops cleanly on Ctrl-C.
SUPERVISOR = CommandDef(name='supervisor', help='Run the per-container supervisor (internal; spawned by the OCI hook)', handler=(LazyHandler('terok_sandbox.commands.supervisor:_handle_supervisor')), group='internal', args=(ArgDef(name='container_id', help='Container ID the supervisor manages'), ArgDef(name='sidecar_path', help='Absolute path to the per-container sidecar JSON'), ArgDef(name='container_pid', help='Container init host-PID (from the createRuntime hook); enables the direct PID watch', type=int, nargs='?', default=None)))
module-attribute
SUPERVISE_CHILD = CommandDef(name='supervise-child', help='Run one hardened supervisor service (internal; spawned by the supervisor)', handler=(LazyHandler('terok_sandbox.commands.supervisor:_handle_supervise_child')), group='internal', args=(ArgDef(name='service', help='Service to run (verdict|clearance|gate|vault|signer)'), ArgDef(name='container_id', help='Container ID the service belongs to'), ArgDef(name='sidecar_path', help='Absolute path to the per-container sidecar JSON')))
module-attribute
SUPERVISOR_COMMANDS = (SUPERVISOR, SUPERVISE_CHILD)
module-attribute
__all__ = ['SUPERVISE_CHILD', 'SUPERVISOR', 'SUPERVISOR_COMMANDS']
module-attribute