hakurei/container/container.go, branch masterlow-level userspace tooling for Rosa OShttp://src.rosa.moe/hakurei/atom/container/container.go?h=master2026-06-08T05:58:24Zall: apply modernisers2026-06-08T05:58:24ZOphestracat@gensokyo.uk2026-06-08T05:19:11Zurn:sha1:f869ff95a12756de97827b4afd93763f9661f144
Signed-off-by: Ophestra <cat@gensokyo.uk>
container: binfmt registration2026-05-07T06:55:19ZOphestracat@gensokyo.uk2026-05-07T06:40:47Zurn:sha1:575ef307ad5cedb13a514cd038a4880ab8c91242
This arranges for binfmt entries to be registered for the container.
Signed-off-by: Ophestra <cat@gensokyo.uk>
container: optionally map uid/gid 0 as init2026-05-07T06:15:47ZOphestracat@gensokyo.uk2026-05-07T06:15:28Zurn:sha1:d4144fcf7f9217d2a2dcec21202421d5fa9d4928
Unfortunately required to work around flawed APIs like binfmt_misc.
Signed-off-by: Ophestra <cat@gensokyo.uk>
container: optionally suppress init verbosity2026-05-05T10:59:44ZOphestracat@gensokyo.uk2026-05-05T10:59:44Zurn:sha1:09d9f766a94c9261a7e6c4c24b52e718d6d5fe86
This change also removes verbose output no longer considered useful.
Signed-off-by: Ophestra <cat@gensokyo.uk>
internal/landlock: relocate from package container2026-04-10T14:56:45ZOphestracat@gensokyo.uk2026-04-10T14:56:45Zurn:sha1:b39064037625d1757a65913086ec3a247ad5bb29
This is not possible to use directly, so remove it from the public API.
Signed-off-by: Ophestra <cat@gensokyo.uk>
container: unexport PR_SET_NO_NEW_PRIVS wrapper2026-04-10T14:45:51ZOphestracat@gensokyo.uk2026-04-10T14:45:51Zurn:sha1:ad2c9f36cddfd8adcd06fbe9238d176a8eb89614
This is subtle to use correctly. It also does not make sense as part of the container API.
Signed-off-by: Ophestra <cat@gensokyo.uk>
container: do not set static deadline2026-04-07T08:00:20ZOphestracat@gensokyo.uk2026-04-07T07:50:33Zurn:sha1:0558032c2d6b467b4807e69db74e24c5577c34bc
This usually ends up in the buffer, or completes well before the deadline, however this can still timeout on a very slow system.
Signed-off-by: Ophestra <cat@gensokyo.uk>
container: remove setup pipe helper2026-04-07T07:05:33ZOphestracat@gensokyo.uk2026-04-07T06:50:59Zurn:sha1:062edb3487c1cc116cae78bf77420b65c43517d1
The API forces use of finalizer to close the read end of the setup pipe, which is no longer considered acceptable. Exporting this as part of package container also imposes unnecessary maintenance burden.
Signed-off-by: Ophestra <cat@gensokyo.uk>
container: skip landlock on hostnet2026-04-07T05:36:44ZOphestracat@gensokyo.uk2026-04-07T05:36:44Zurn:sha1:c758e762bd0334b6f86fbc41ab3223b9115e9982
This overlaps with net namespace, so can be skipped without degrading security.
Signed-off-by: Ophestra <cat@gensokyo.uk>
fhs: move from container2026-03-17T06:56:36ZOphestracat@gensokyo.uk2026-03-17T06:56:36Zurn:sha1:722989c68256469963aee963bed9c6ab4bf55b67
This package is not container-specific.
Signed-off-by: Ophestra <cat@gensokyo.uk>