Method writeFiles

worker/src/utils/isolated-volume.ts:163–183

* Writes files to the volume using a temporary Alpine container. * * @param files - Map of filename to content

(files: Record<string, string | Buffer>)

   * @param files - Map of filename to content
   */
  private async writeFiles(files: Record<string, string | Buffer>): Promise<void> {
    if (!this.volumeName) {
      throw new ConfigurationError('Volume not initialized', {
        details: { tenantId: this.tenantId, runId: this.runId },
      });
    }

    for (const [filename, content] of Object.entries(files)) {
      // Strict validation to prevent path traversal and shell injection
      this.validateFilename(filename);

      const contentString = typeof content === 'string' ? content : content.toString('utf-8');

      // Use docker run with stdin to write the file
      await this.writeFileToVolume(filename, contentString);
    }

    // Make the volume directory writable by all users (including nonroot containers)
    // This is safe because volumes are isolated per-run
    await this.setVolumePermissions();
  }

  /**
   * Sets permissions on the volume directory to allow nonroot containers to write.