hakurei/sandbox/ops.go, branch developlow-level userspace tooling for Rosa OShttp://src.rosa.moe/hakurei/atom/sandbox/ops.go?h=develop2025-07-02T12:23:55Zhakurei: move container toplevel2025-07-02T12:23:55ZOphestracat@gensokyo.uk2025-07-02T12:23:55Zurn:sha1:a1d98823f8d17b49b432508d071b62ccd426f1ce
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox: expose seccomp interface2025-07-01T19:47:13ZOphestracat@gensokyo.uk2025-07-01T19:38:28Zurn:sha1:31aef905fa819310ee7694775a836c294ff742e4
There's no point in artificially limiting and abstracting away these options. The higher level hakurei package is responsible for providing a secure baseline and sane defaults. The sandbox package should present everything to the caller.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox/seccomp: import dot for syscall2025-07-01T17:30:35ZOphestracat@gensokyo.uk2025-07-01T17:30:35Zurn:sha1:a6887f7253ae822357f0d4d019675acc8c3e0b4d
This significantly increases readability in some places.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox/seccomp: append suffix to ops2025-07-01T16:09:04ZOphestracat@gensokyo.uk2025-07-01T16:09:04Zurn:sha1:69bd581af78909ce924b810da67979b57c5b5747
This avoids clashes with stdlib names to allow for . imports.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox: relative autoetc links2025-04-11T09:54:00ZOphestracat@gensokyo.uk2025-04-11T09:54:00Zurn:sha1:996790946092a9291eb21e297d1f0f04deab8b42
This allows nested containers to use autoetc, and increases compatibility with other implementations.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox: implement autoetc as setup op2025-04-10T09:54:25ZOphestracat@gensokyo.uk2025-04-10T09:54:25Zurn:sha1:c806f43881223a85ad888f434e078dcc68de028d
This significantly reduces setup op count and the readdir call now happens in the context of the init process.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox: document less obvious parts of setup2025-03-31T16:21:04ZOphestracat@gensokyo.uk2025-03-31T16:21:04Zurn:sha1:0ba8be659f0bb22065824190e2d872d869a2fe92
Signed-off-by: Ophestra <cat@gensokyo.uk>