mirror of https://github.com/microsoft/regorus.git synced 2026-08-05 02:16:11 +00:00

Files

Anand Krishnamoorthi fd59bb5a91 feat(memory): Allocator-backed global memory limits (#544 )

Policy evaluation at scale needs to be able to set memory limits
so that a bad policy does not hog memory or to ensure that
policy evaluation itself does not use too much memory which could
cause other components to suffer.

This PR introduces capability to set and enforce global memory limits.
It also lays the groundwork for enabling per evaluation limits in future.

Once a global memory limit is set, Regorus maintains per thread counters
to track memory activity (allocation, deallocation) of a thread.
These counters are periodically flushed to global memory counters.
Per thread counters avoid the contention that updating global counters
on each alloc/free would cause.

Policy evaluation periodically checks these counters and raises errors
if allocated memory has exceeded the configured limit.

Currently memory limit capability is exposed only to FFI and C#.

Also update mimalloc to v2.2.6

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

2026-01-24 07:08:54 +05:30

src

feat: Update to OPA v1.2.0 (#373 )

2025-03-10 11:56:01 -07:00

.python-version

Python bindings (#115 )

2024-01-28 14:39:59 -08:00

building.md

Document bindings (#119 )

2024-02-01 13:47:27 -08:00

Cargo.lock

feat(memory): Allocator-backed global memory limits (#544 )

2026-01-24 07:08:54 +05:30

Cargo.toml

chore: Regorus v0.5.0 release (#432 )

2025-07-08 16:40:06 -05:00

CHANGELOG.md

Revert "chore: release v0.2.0 (#257 )" (#258 )

2024-05-30 06:09:47 -07:00

pyproject.toml

build: Python binding portability (#388 )

2025-04-07 13:18:01 -07:00

README.md

Update bindings to include newer APIs (#250 )

2024-05-25 10:24:06 -07:00

test_extensions.py

add extension_list example (#281 )

2024-07-16 11:08:37 +05:30

test.py

feat: Update to OPA v1.2.0 (#373 )

2025-03-10 11:56:01 -07:00

README.md

regorus

Regorus is

Rego-Rus(t) - A fast, light-weight Rego interpreter written in Rust.
Rigorous - A rigorous enforcer of well-defined Rego semantics.

Regorus can be used in Python via regorus package. (It is not yet available in PyPI, but can be manually built.)

See Repository.

To build this binding, see building

Usage

import regorus

# Create engine
engine = regorus.Engine()

# Load policies
engine.add_policy_from_file('../../tests/aci/framework.rego')
engine.add_policy_from_file('../../tests/aci/api.rego')
engine.add_policy_from_file('../../tests/aci/policy.rego')

# Add policy data
data = {
  "metadata": {
    "devices": {
      "/run/layers/p0-layer0": "1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766",
      "/run/layers/p0-layer1": "e769d7487cc314d3ee748a4440805317c19262c7acd2fdbdb0d47d2e4613a15c",
      "/run/layers/p0-layer2": "eb36921e1f82af46dfe248ef8f1b3afb6a5230a64181d960d10237a08cd73c79",
      "/run/layers/p0-layer3": "41d64cdeb347bf236b4c13b7403b633ff11f1cf94dbc7cf881a44d6da88c5156",
      "/run/layers/p0-layer4": "4dedae42847c704da891a28c25d32201a1ae440bce2aecccfa8e6f03b97a6a6c",
      "/run/layers/p0-layer5": "fe84c9d5bfddd07a2624d00333cf13c1a9c941f3a261f13ead44fc6a93bc0e7a"
    }
  }
}
engine.add_data(data)

# Set input
input = {
  "containerID": "container0",
  "layerPaths": [
    "/run/layers/p0-layer0",
    "/run/layers/p0-layer1",
    "/run/layers/p0-layer2",
    "/run/layers/p0-layer3",
    "/run/layers/p0-layer4",
    "/run/layers/p0-layer5"
  ],
  "target": "/run/gcs/c/container0/rootfs"
}
engine.set_input(input)

# Eval rule
value = engine.eval_rule('data.framework.mount_overlay')

# Print value
print(value)