chore: import upstream snapshot with attribution

examples/python/runtimes/daytona/daytona_fuse.py

@@ -0,0 +1,71 @@
+# ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+
+import os
+import sys
+from pathlib import Path
+
+from daytona import (CreateSandboxFromImageParams, Daytona, DaytonaConfig,
+                     Resources)
+from dotenv import load_dotenv
+from remote_env import fuse_image, remote_env
+
+load_dotenv(".env.development")
+
+REMOTE_SCRIPT = Path(__file__).parent / "remote" / "fuse.py"
+
+
+def main():
+    daytona = Daytona(DaytonaConfig(api_key=os.environ["DAYTONA_API_KEY"]))
+
+    print("=== building image (debian-slim + git + fuse3 + mirage-ai[s3]) ===")
+    sandbox = daytona.create(
+        CreateSandboxFromImageParams(
+            image=fuse_image(),
+            resources=Resources(cpu=1, memory=1, disk=1),
+        ),
+        timeout=600,
+        on_snapshot_create_logs=lambda line: print(f"  build: {line}"),
+    )
+    print(f"\n=== sandbox up: {sandbox.id} ===\n")
+
+    try:
+        probe = sandbox.process.exec(
+            "test -e /dev/fuse && echo HAS_FUSE || echo NO_FUSE; "
+            "fusermount3 --version 2>&1 | head -1 || true",
+            timeout=15,
+        )
+        print("=== sandbox FUSE probe ===")
+        print(probe.result.rstrip())
+        print()
+
+        sandbox.fs.upload_file(REMOTE_SCRIPT.read_bytes(), "/tmp/run.py")
+        result = sandbox.process.exec(
+            "python /tmp/run.py",
+            cwd="/tmp",
+            env=remote_env(),
+            timeout=120,
+        )
+        print("=== remote output ===")
+        print(result.result.rstrip())
+        if result.exit_code != 0:
+            print(f"\n=== exit code: {result.exit_code} ===", file=sys.stderr)
+            sys.exit(result.exit_code)
+    finally:
+        print(f"\n=== deleting sandbox {sandbox.id} ===")
+        sandbox.delete()
+
+
+if __name__ == "__main__":
+    main()

examples/python/runtimes/daytona/daytona_vfs.py

@@ -0,0 +1,62 @@
+# ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+
+import os
+import sys
+from pathlib import Path
+
+from daytona import (CreateSandboxFromImageParams, Daytona, DaytonaConfig,
+                     Resources)
+from dotenv import load_dotenv
+from remote_env import base_image, remote_env
+
+load_dotenv(".env.development")
+
+REMOTE_SCRIPT = Path(__file__).parent / "remote" / "vfs.py"
+
+
+def main():
+    daytona = Daytona(DaytonaConfig(api_key=os.environ["DAYTONA_API_KEY"]))
+
+    print("=== building image (debian-slim + git + mirage-ai[s3]) ===")
+    sandbox = daytona.create(
+        CreateSandboxFromImageParams(
+            image=base_image(),
+            resources=Resources(cpu=1, memory=1, disk=1),
+        ),
+        timeout=600,
+        on_snapshot_create_logs=lambda line: print(f"  build: {line}"),
+    )
+    print(f"\n=== sandbox up: {sandbox.id} ===\n")
+
+    try:
+        sandbox.fs.upload_file(REMOTE_SCRIPT.read_bytes(), "/tmp/run.py")
+        result = sandbox.process.exec(
+            "python /tmp/run.py",
+            cwd="/tmp",
+            env=remote_env(),
+            timeout=120,
+        )
+        print("=== remote output ===")
+        print(result.result.rstrip())
+        if result.exit_code != 0:
+            print(f"\n=== exit code: {result.exit_code} ===", file=sys.stderr)
+            sys.exit(result.exit_code)
+    finally:
+        print(f"\n=== deleting sandbox {sandbox.id} ===")
+        sandbox.delete()
+
+
+if __name__ == "__main__":
+    main()

examples/python/runtimes/daytona/remote/fuse.py

@@ -0,0 +1,53 @@
+# ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+
+# Runs inside a Daytona sandbox (uploaded by ../daytona_fuse.py).
+
+import os
+import subprocess
+import time
+
+from mirage import Mount, MountMode, Workspace
+from mirage.resource.s3 import S3Config, S3Resource
+
+cfg = S3Config(
+    bucket=os.environ["AWS_S3_BUCKET"],
+    region=os.environ.get("AWS_DEFAULT_REGION", "us-east-1"),
+    aws_access_key_id=os.environ["AWS_ACCESS_KEY_ID"],
+    aws_secret_access_key=os.environ["AWS_SECRET_ACCESS_KEY"],
+)
+
+with Workspace(
+    {"/s3/": Mount(S3Resource(cfg), fuse=True)},
+        mode=MountMode.READ,
+) as ws:
+    time.sleep(1)
+    mp = ws.fuse_mountpoint
+    print(f"FUSE mountpoint: {mp}")
+
+    print("\n--- native os.listdir() against FUSE path ---")
+    for e in os.listdir(mp):
+        print(f"  {e}")
+
+    print("\n--- subprocess sees the same mount ---")
+    r = subprocess.run(["ls", mp], capture_output=True, text=True)
+    print(r.stdout.rstrip())
+
+    print("\n--- native open() reads through FUSE ---")
+    path = f"{mp}/data/example.jsonl"
+    size = os.path.getsize(path)
+    with open(path) as f:
+        head = "".join(next(f) for _ in range(3))
+    print(f"  size: {size} bytes")
+    print(f"  head:\n{head.rstrip()}")

examples/python/runtimes/daytona/remote/vfs.py

@@ -0,0 +1,45 @@
+# ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+
+# Runs inside a Daytona sandbox (uploaded by ../daytona_vfs.py).
+
+import asyncio
+import os
+
+from mirage import MountMode, Workspace
+from mirage.resource.s3 import S3Config, S3Resource
+
+
+async def run():
+    cfg = S3Config(
+        bucket=os.environ["AWS_S3_BUCKET"],
+        region=os.environ.get("AWS_DEFAULT_REGION", "us-east-1"),
+        aws_access_key_id=os.environ["AWS_ACCESS_KEY_ID"],
+        aws_secret_access_key=os.environ["AWS_SECRET_ACCESS_KEY"],
+    )
+    with Workspace({"/s3/": S3Resource(cfg)}, mode=MountMode.READ) as ws:
+        r = await ws.execute("ls /s3/")
+        print("--- ls /s3/ ---")
+        print((await r.stdout_str()).rstrip())
+
+        r = await ws.execute("grep -c mirage /s3/data/example.jsonl")
+        print("\n--- grep -c mirage /s3/data/example.jsonl ---")
+        print((await r.stdout_str()).rstrip())
+
+        records = ws.ops.records
+        total = sum(rec.bytes for rec in records)
+        print(f"\nremote stats: {len(records)} ops, {total} bytes")
+
+
+asyncio.run(run())

examples/python/runtimes/daytona/remote_env.py

@@ -0,0 +1,47 @@
+# ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+
+import os
+
+from daytona import Image
+
+MIRAGE_GIT_SPEC = (
+    "mirage-ai[s3] @ "
+    "git+https://github.com/strukto-ai/mirage.git#subdirectory=python")
+
+
+def remote_env() -> dict[str, str]:
+    return {
+        "AWS_S3_BUCKET": os.environ["AWS_S3_BUCKET"],
+        "AWS_DEFAULT_REGION": os.environ.get("AWS_DEFAULT_REGION",
+                                             "us-east-1"),
+        "AWS_ACCESS_KEY_ID": os.environ["AWS_ACCESS_KEY_ID"],
+        "AWS_SECRET_ACCESS_KEY": os.environ["AWS_SECRET_ACCESS_KEY"],
+    }
+
+
+def base_image() -> Image:
+    return (Image.debian_slim("3.12").run_commands(
+        "apt-get update "
+        "&& apt-get install -y --no-install-recommends git "
+        "&& rm -rf /var/lib/apt/lists/*").pip_install(MIRAGE_GIT_SPEC))
+
+
+def fuse_image() -> Image:
+    return (Image.debian_slim("3.12").run_commands(
+        "apt-get update "
+        "&& apt-get install -y --no-install-recommends "
+        "    git fuse3 libfuse3-dev "
+        "&& sed -i 's/^#user_allow_other/user_allow_other/' /etc/fuse.conf "
+        "&& rm -rf /var/lib/apt/lists/*").pip_install(MIRAGE_GIT_SPEC))

examples/python/runtimes/microsandbox/README.md

@@ -0,0 +1,84 @@
+# Microsandbox + Mirage FUSE
+
+Run an untrusted [Microsandbox](https://microsandbox.dev) microVM that reads S3
+through a host-side Mirage FUSE mount. Mirage FUSE-mounts S3 on the **host**;
+Microsandbox bind-mounts that path into the microVM over virtio-fs. The guest
+reads `/s3` natively, with no S3 credentials and no network of its own.
+
+## How it works
+
+```
+microVM guest  --virtio-fs /s3-->  host FUSE mountpoint  -->  Mirage  -->  S3
+ (msb / libkrun)                       (fuse3)
+```
+
+1. `microsandbox_fuse.py` (host) FUSE-mounts an `S3Resource` at a temp mountpoint.
+1. It boots a microVM with `Volume.bind(<mountpoint>, readonly=True)` mapped to
+   `/s3`, so the guest's `/s3` is backed by the host FUSE mount over virtio-fs.
+1. `remote/guest.py` runs inside the microVM: it `os.listdir('/s3')` and reads
+   `/s3/data/example.jsonl` as if they were local files.
+
+The microVM guest has no `/dev/fuse`, so Mirage can't run in the guest; the host
+mount is shared in instead.
+
+## Prerequisites
+
+- **Microsandbox Python SDK**: `uv pip install microsandbox` (tested with 0.5.10).
+- **`msb` runtime** (provides libkrunfw): `curl -sSfL https://get.microsandbox.dev | sh`.
+  On Apple Silicon this also pulls the libkrun HVF backend; x86_64 macOS is not
+  supported by Microsandbox.
+- **Host FUSE**: Linux `fuse3` (see platform note below for macOS).
+- **AWS credentials** in `.env.development` at the repo root:
+  `AWS_S3_BUCKET`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and optionally
+  `AWS_DEFAULT_REGION`.
+- The bucket must contain `data/example.jsonl` (any text/JSONL file works; the
+  guest just counts lines containing `mirage`).
+
+The SDK 0.5.10 embeds the runtime in-process, so there is **no separate `msb server` to start** (just run the example).
+
+## Run
+
+From the repo root (so `.env.development` loads):
+
+```bash
+./python/.venv/bin/python examples/python/runtimes/microsandbox/microsandbox_fuse.py
+```
+
+Expected tail:
+
+```
+=== guest output ===
+--- os.listdir('/s3') ---
+  data
+  ...
+--- read /s3/data/example.jsonl through virtio-fs -> FUSE -> Mirage -> S3 ---
+  5766 lines, 5678 containing 'mirage'
+
+Mirage served N ops, ... bytes to the sandbox
+```
+
+## Platform note: Linux only
+
+This example runs on **Linux**. On **macOS it does not work**: libkrun's virtio-fs
+cannot re-export a macFUSE-backed directory into the microVM. Booting the VM
+fails at the bind-mount with:
+
+```
+failed to start "mirage-fuse": mount s3_<hash>: Operation not permitted (os error 1)
+```
+
+This is a libkrun + macFUSE interaction, not a Mirage or Microsandbox bug:
+
+- It reproduces with both S3-backed and RAM-backed FUSE mounts (the trigger is the
+  macFUSE filesystem type, not the backend).
+- A plain (non-FUSE) host directory bind-mounts and reads fine inside the same
+  microVM, so virtio-fs itself works on macOS.
+- Mounting the FUSE filesystem with `allow_other` does not help; the failure is
+  `EPERM` (not `EACCES`), from a macOS-specific VFS operation libkrun's host-side
+  virtio-fs server issues during share setup that macFUSE rejects.
+
+On macOS, use the sibling [`wasmer`](../wasmer/README.md) example instead: it maps
+the same host FUSE mount into a WASIX guest with `--mapdir` and works on macOS.
+
+Not run in CI. It needs the Microsandbox runtime, host FUSE, and live AWS
+credentials.

examples/python/runtimes/microsandbox/microsandbox_fuse.py

@@ -0,0 +1,85 @@
+# ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+
+# The microVM guest has no /dev/fuse, so Mirage FUSE-mounts S3 on the HOST and
+# Microsandbox bind-mounts that path in over virtio-fs. The guest reads it
+# natively, with no S3 credentials and no network of its own.
+# Requires a running Microsandbox server (`msb server start`), host FUSE
+# (Linux fuse3 or macOS macFUSE), and AWS creds in .env.development.
+
+import asyncio
+import os
+import sys
+from pathlib import Path
+
+from dotenv import load_dotenv
+from microsandbox import Sandbox, Volume
+
+from mirage import Mount, MountMode, Workspace
+from mirage.resource.s3 import S3Config, S3Resource
+
+load_dotenv(".env.development")
+
+REMOTE_DIR = Path(__file__).parent / "remote"
+
+
+def s3_config() -> S3Config:
+    return S3Config(
+        bucket=os.environ["AWS_S3_BUCKET"],
+        region=os.environ.get("AWS_DEFAULT_REGION", "us-east-1"),
+        aws_access_key_id=os.environ["AWS_ACCESS_KEY_ID"],
+        aws_secret_access_key=os.environ["AWS_SECRET_ACCESS_KEY"],
+    )
+
+
+async def main():
+    print("=== Mirage FUSE-mounting S3 on the host ===")
+    with Workspace({
+            "/s3/":
+            Mount(S3Resource(s3_config()), mode=MountMode.READ, fuse=True)
+    }) as ws:
+        host_s3 = ws.fuse_mountpoint
+        print(f"  host mountpoint: {host_s3}")
+
+        print(
+            "\n=== booting microVM (S3 mount bind-mounted in, no network) ===")
+        async with await Sandbox.create(
+                "mirage-fuse",
+                image="python",
+                memory=1024,
+                cpus=1,
+                volumes={
+                    "/s3": Volume.bind(host_s3, readonly=True),
+                    "/prog": Volume.bind(str(REMOTE_DIR), readonly=True),
+                },
+                replace=True,
+        ) as sandbox:
+            result = await sandbox.exec("python", ["/prog/guest.py"])
+            print("=== guest output ===")
+            print(result.stdout_text.rstrip())
+            if result.exit_code != 0:
+                print(result.stderr_text, file=sys.stderr)
+                print(f"\n=== exit code: {result.exit_code} ===",
+                      file=sys.stderr)
+                sys.exit(result.exit_code)
+
+        records = ws.ops.records
+        total = sum(rec.bytes for rec in records)
+        print(
+            f"\nMirage served {len(records)} ops, {total} bytes to the sandbox"
+        )
+
+
+if __name__ == "__main__":
+    asyncio.run(main())

examples/python/runtimes/microsandbox/remote/guest.py

@@ -0,0 +1,33 @@
+# ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+
+# Runs inside a Microsandbox microVM (invoked by ../microsandbox_fuse.py).
+# /s3 is a host directory that Mirage FUSE-mounted from S3, bind-mounted in
+# via virtio-fs. No S3 credentials or network reach this guest.
+
+import os
+
+print("--- os.listdir('/s3') ---")
+for entry in sorted(os.listdir("/s3")):
+    print(f"  {entry}")
+
+path = "/s3/data/example.jsonl"
+print(f"\n--- read {path} through virtio-fs -> FUSE -> Mirage -> S3 ---")
+with open(path) as f:
+    lines = f.readlines()
+hits = sum(1 for line in lines if "mirage" in line)
+print(f"  {len(lines)} lines, {hits} containing 'mirage'")
+print("  head:")
+for line in lines[:3]:
+    print(f"    {line.rstrip()}")

examples/python/runtimes/wasmer/README.md

@@ -0,0 +1,68 @@
+# Wasmer + Mirage FUSE
+
+Run an untrusted [Wasmer](https://wasmer.io) (WASM/WASIX) sandbox that reads S3
+through a host-side Mirage FUSE mount. The guest sees a normal `/s3` directory
+and never touches S3 credentials or the network.
+
+## How it works
+
+```
+WASIX Python guest  --mapdir /s3-->  host FUSE mountpoint  -->  Mirage  -->  S3
+   (wasmer run)                         (macFUSE / fuse3)
+```
+
+1. `wasmer_fuse.py` (host) FUSE-mounts an `S3Resource` at a temp mountpoint.
+1. It launches `wasmer run python/python` with `--mapdir /s3:<mountpoint>`, so the
+   guest's `/s3` is backed by the host FUSE mount.
+1. `remote/guest.py` runs inside the WASIX guest: it `os.listdir('/s3')` and reads
+   `/s3/data/example.jsonl` as if they were local files.
+
+Mirage stays on the host because the Python `wasmer` binding is frozen at 3.10;
+we drive the actively-maintained `wasmer` CLI as a subprocess instead.
+
+## Prerequisites
+
+- **`wasmer` CLI** on `PATH`: install from <https://wasmer.io> (`curl https://get.wasmer.io -sSfL | sh`).
+- **Host FUSE**: macOS [macFUSE](https://macfuse.github.io/), or Linux `fuse3`.
+- **AWS credentials** in `.env.development` at the repo root:
+  `AWS_S3_BUCKET`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and optionally
+  `AWS_DEFAULT_REGION`.
+- The bucket must contain `data/example.jsonl` (any text/JSONL file works; the
+  guest just counts lines containing `mirage`).
+
+## Run
+
+From the repo root (so `.env.development` loads):
+
+```bash
+./python/.venv/bin/python examples/python/runtimes/wasmer/wasmer_fuse.py
+```
+
+Expected tail:
+
+```
+=== guest output ===
+--- os.listdir('/s3') ---
+  data
+  ...
+--- read /s3/data/example.jsonl through Wasmer -> FUSE -> Mirage -> S3 ---
+  5766 lines, 5678 containing 'mirage'
+
+Mirage served 104 ops, 10432116 bytes to the sandbox
+```
+
+## First-run note
+
+The very first `wasmer run python/python` downloads the WASIX Python package from
+the Wasmer registry, which can take a few minutes. The example's subprocess
+timeout (180s) may fire during that cold download and surface as a
+`TimeoutExpired` traceback. Warm the cache once, then re-run:
+
+```bash
+wasmer run python/python -- -c "print('warm')"
+```
+
+## Platform support
+
+Works on both **macOS** (macFUSE) and **Linux** (fuse3). Not run in CI. It
+needs the `wasmer` CLI, host FUSE, and live AWS credentials.

examples/python/runtimes/wasmer/remote/guest.py

@@ -0,0 +1,32 @@
+# ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+
+# Runs inside Wasmer's python/python WASIX module (via ../wasmer_fuse.py).
+# /s3 is a host dir Mirage FUSE-mounted from S3, mapped in with --mapdir.
+
+import os
+
+print("--- os.listdir('/s3') ---")
+for entry in sorted(os.listdir("/s3")):
+    print(f"  {entry}")
+
+path = "/s3/data/example.jsonl"
+print(f"\n--- read {path} through Wasmer -> FUSE -> Mirage -> S3 ---")
+with open(path) as f:
+    lines = f.readlines()
+hits = sum(1 for line in lines if "mirage" in line)
+print(f"  {len(lines)} lines, {hits} containing 'mirage'")
+print("  head:")
+for line in lines[:3]:
+    print(f"    {line.rstrip()}")

examples/python/runtimes/wasmer/wasmer_fuse.py

@@ -0,0 +1,93 @@
+# ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+
+# Host prerequisites: the `wasmer` CLI, FUSE (Linux fuse3 or macOS macFUSE),
+# and AWS credentials in .env.development. The Python `wasmer` binding is dead
+# (no 3.11+ wheels), so we drive the actively-maintained CLI as a subprocess.
+
+import os
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+from dotenv import load_dotenv
+
+from mirage import Mount, MountMode, Workspace
+from mirage.resource.s3 import S3Config, S3Resource
+
+load_dotenv(".env.development")
+
+REMOTE_DIR = Path(__file__).parent / "remote"
+
+
+def s3_config() -> S3Config:
+    return S3Config(
+        bucket=os.environ["AWS_S3_BUCKET"],
+        region=os.environ.get("AWS_DEFAULT_REGION", "us-east-1"),
+        aws_access_key_id=os.environ["AWS_ACCESS_KEY_ID"],
+        aws_secret_access_key=os.environ["AWS_SECRET_ACCESS_KEY"],
+    )
+
+
+def main():
+    wasmer = shutil.which("wasmer")
+    if wasmer is None:
+        print("wasmer CLI not found on PATH; install from https://wasmer.io",
+              file=sys.stderr)
+        sys.exit(1)
+
+    print("=== Mirage FUSE-mounting S3 on the host ===")
+    with Workspace({
+            "/s3/":
+            Mount(S3Resource(s3_config()), mode=MountMode.READ, fuse=True)
+    }) as ws:
+        host_s3 = ws.fuse_mountpoint
+        print(f"  host mountpoint: {host_s3}")
+
+        print(
+            "\n=== wasmer run python/python (reads /s3 via the mapped dir) ==="
+        )
+        result = subprocess.run(
+            [
+                wasmer,
+                "run",
+                "--mapdir",
+                f"/s3:{host_s3}",
+                "--mapdir",
+                f"/prog:{REMOTE_DIR}",
+                "python/python",
+                "--",
+                "/prog/guest.py",
+            ],
+            capture_output=True,
+            text=True,
+            timeout=180,
+        )
+        print("=== guest output ===")
+        print(result.stdout.rstrip())
+        if result.returncode != 0:
+            print(result.stderr.rstrip(), file=sys.stderr)
+            print(f"\n=== exit code: {result.returncode} ===", file=sys.stderr)
+            sys.exit(result.returncode)
+
+        records = ws.ops.records
+        total = sum(rec.bytes for rec in records)
+        print(
+            f"\nMirage served {len(records)} ops, {total} bytes to the sandbox"
+        )
+
+
+if __name__ == "__main__":
+    main()