Executor Shell

Generic shell command executor for the MuxCore worker pool.

A MuxCore sidecar module that executes shell commands from worker pool tasks. When a task arrives with type "shell", it runs the payload as a shell command and returns the output.

---

How It Works

Worker pool task ──→ executor-shell (gRPC) ──→ sh -c "<payload>"
                                                   │
                                                   ▼
                                    success → Result = stdout
                                    failure → Error = stderr (or exec error)

Capability: executor.shell
Contract: Executor (v0.4.0, min core 0.4.0)
Task type: shell

---

Configuration

Environment Variables

Variable	Default	Description
EXECUTOR_GRPC_ADDR	:9602	gRPC listen address
EXECUTOR_ALLOWED_COMMANDS	"" (deny all)	Comma-separated command prefixes. Empty denies every command. Use * only in local tests — never in production (see SECURITY.md).

Security

Commands are checked against EXECUTOR_ALLOWED_COMMANDS before execution:

• Empty — deny all (fail-closed default).
• Prefixes — e.g. git,make,ls allows only payloads that start with one of those prefixes.
• * — unrestricted (explicit opt-in).

Rejected commands are logged at WARN level.

---

Development

make build   # compile the module binary
make test    # run tests with race detection
make lint    # golangci-lint
make fmt     # format Go source
make tidy    # go mod tidy

Deployment

Docker

make docker      # build image
make docker-push # build and push

Systemd

Copy the service unit and binary:

cp deploy/systemd/muxcore-module.service /etc/systemd/system/executor-shell.service
cp executor-shell /usr/local/bin/executor-shell
systemctl daemon-reload
systemctl enable --now executor-shell