hakurei/container/container.go, branch v0.4.0low-level userspace tooling for Rosa OShttp://src.rosa.moe/hakurei/atom/container/container.go?h=v0.4.02026-04-10T14:56:45Zinternal/landlock: relocate from package container2026-04-10T14:56:45ZOphestracat@gensokyo.uk2026-04-10T14:56:45Zurn:sha1:b39064037625d1757a65913086ec3a247ad5bb29
This is not possible to use directly, so remove it from the public API.
Signed-off-by: Ophestra <cat@gensokyo.uk>
container: unexport PR_SET_NO_NEW_PRIVS wrapper2026-04-10T14:45:51ZOphestracat@gensokyo.uk2026-04-10T14:45:51Zurn:sha1:ad2c9f36cddfd8adcd06fbe9238d176a8eb89614
This is subtle to use correctly. It also does not make sense as part of the container API.
Signed-off-by: Ophestra <cat@gensokyo.uk>
container: do not set static deadline2026-04-07T08:00:20ZOphestracat@gensokyo.uk2026-04-07T07:50:33Zurn:sha1:0558032c2d6b467b4807e69db74e24c5577c34bc
This usually ends up in the buffer, or completes well before the deadline, however this can still timeout on a very slow system.
Signed-off-by: Ophestra <cat@gensokyo.uk>
container: remove setup pipe helper2026-04-07T07:05:33ZOphestracat@gensokyo.uk2026-04-07T06:50:59Zurn:sha1:062edb3487c1cc116cae78bf77420b65c43517d1
The API forces use of finalizer to close the read end of the setup pipe, which is no longer considered acceptable. Exporting this as part of package container also imposes unnecessary maintenance burden.
Signed-off-by: Ophestra <cat@gensokyo.uk>
container: skip landlock on hostnet2026-04-07T05:36:44ZOphestracat@gensokyo.uk2026-04-07T05:36:44Zurn:sha1:c758e762bd0334b6f86fbc41ab3223b9115e9982
This overlaps with net namespace, so can be skipped without degrading security.
Signed-off-by: Ophestra <cat@gensokyo.uk>
fhs: move from container2026-03-17T06:56:36ZOphestracat@gensokyo.uk2026-03-17T06:56:36Zurn:sha1:722989c68256469963aee963bed9c6ab4bf55b67
This package is not container-specific.
Signed-off-by: Ophestra <cat@gensokyo.uk>
check: move from container2026-03-17T06:39:03ZOphestracat@gensokyo.uk2026-03-17T06:35:58Zurn:sha1:6d015a949e27f20c86409c7d78053f0b0493f165
This package is not container specific, and widely used across the project.
Signed-off-by: Ophestra <cat@gensokyo.uk>
container: set CLOEXEC via close_range2026-03-17T05:19:00ZOphestracat@gensokyo.uk2026-03-17T05:19:00Zurn:sha1:0a12d456ce5869042dc06c43c360c43cab942d6b
This is guarded behind the close_range build tag for now.
Signed-off-by: Ophestra <cat@gensokyo.uk>
ext: isolate from container/std2026-03-17T04:39:26ZOphestracat@gensokyo.uk2026-03-17T04:35:48Zurn:sha1:cd5959fe5ab04786cd5dee3cf09f725229ae7c7b
These are too general to belong in the container package. This targets the v0.4 release to reduce the wrapper maintenance burden.
Signed-off-by: Ophestra <cat@gensokyo.uk>
container: expose priority and SCHED_OTHER policy2026-03-11T16:14:03ZOphestracat@gensokyo.uk2026-03-11T16:14:03Zurn:sha1:196b200d0f19c41730db439c62db9b39e424f21f
The more explicit API removes the arbitrary limit preventing use of SCHED_OTHER (referred to as SCHED_NORMAL in the kernel). This change also exposes priority value to set.
Signed-off-by: Ophestra <cat@gensokyo.uk>