hakurei/internal/app/instance/common/container.go, branch developlow-level userspace tooling for Rosa OShttp://src.rosa.moe/hakurei/atom/internal/app/instance/common/container.go?h=develop2025-07-02T11:42:51Zcmd/hakurei: move to cmd2025-07-02T11:42:51ZOphestracat@gensokyo.uk2025-07-02T11:42:51Zurn:sha1:eb22a8bcc1ac03357d4073e5d3ed6d0ab5246a37
Having it at the project root never made sense since the "ego" name was deprecated. This change finally addresses it.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox: expose seccomp interface2025-07-01T19:47:13ZOphestracat@gensokyo.uk2025-07-01T19:38:28Zurn:sha1:31aef905fa819310ee7694775a836c294ff742e4
There's no point in artificially limiting and abstracting away these options. The higher level hakurei package is responsible for providing a secure baseline and sane defaults. The sandbox package should present everything to the caller.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox/seccomp: resolve rules natively2025-07-01T13:11:32ZOphestracat@gensokyo.uk2025-07-01T11:23:33Zurn:sha1:1a8840bebc673672235b6e10b1b9386f24751757
This enables loading syscall filter policies from external cross-platform config files.
This also removes a significant amount of C code.
Signed-off-by: Ophestra <cat@gensokyo.uk>
treewide: rename to hakurei2025-06-24T19:57:41ZOphestracat@gensokyo.uk2025-06-24T18:59:52Zurn:sha1:87e008d56de974947ebb99c2cc40b25d3c2cf43e
Fortify makes little sense for a container tool.
Signed-off-by: Ophestra <cat@gensokyo.uk>
app/instance/common: optimise ops allocation2025-04-12T18:49:07ZOphestracat@gensokyo.uk2025-04-12T18:46:07Zurn:sha1:15011c41731157fafd0d317fc273490eba43bdf5
Signed-off-by: Ophestra <cat@gensokyo.uk>
fst: improve config2025-04-12T18:30:19ZOphestracat@gensokyo.uk2025-04-12T18:23:28Zurn:sha1:31b7ddd122d54c36edb101d2c8bdf230651f27d4
The config struct more or less "grew" to what it is today. This change moves things around to make more sense and fixes nonsensical comments describing obsolete behaviour.
Signed-off-by: Ophestra <cat@gensokyo.uk>
app/instance: wrap internal implementation2025-04-12T04:56:41ZOphestracat@gensokyo.uk2025-04-12T04:56:41Zurn:sha1:6309469e933a31a300fbf16d8e77f48dcee402d3
This reduces the scope of the fst package, which was growing questionably large.
Signed-off-by: Ophestra <cat@gensokyo.uk>