hakurei/test/sandbox/case/pdlike.nix, branch developlow-level userspace tooling for Rosa OShttp://src.rosa.moe/hakurei/atom/test/sandbox/case/pdlike.nix?h=develop2026-10-06T10:41:06Ztest/sandbox: migrate tests2026-10-06T10:41:06ZOphestracat@gensokyo.uk2026-10-03T16:05:10Zurn:sha1:a7383510fb05abc98b992240cb76ad4b6c598956
This significantly improves performance, removing overhead of nix,
python, and virtualisation. Running this in an unprivileged container
required patching the kernel, but since special runner setup was already
needed, that was an acceptable tradeoff.
Signed-off-by: Ophestra <cat@gensokyo.uk>
nix: update flake lock2026-06-06T04:14:09ZOphestracat@gensokyo.uk2026-06-05T00:53:15Zurn:sha1:7eafc7b1e4b895d1986280e192aa8d493fff8d96
Was unfortunately not able to implement vm test suite before this release. Hopefully the last nixos update we have to follow.
Signed-off-by: Ophestra <cat@gensokyo.uk>
internal/outcome: expose pipewire via pipewire-pulse2025-12-15T03:57:06ZOphestracat@gensokyo.uk2025-12-15T03:43:58Zurn:sha1:54610aaddcc01e335c34087bc0c3bc1de6d23cf8
This no longer exposes the pipewire socket to the container, and instead mediates access via pipewire-pulse. This makes insecure parts of the protocol inaccessible as explained in the doc comment in hst.
Closes #29.
Signed-off-by: Ophestra <cat@gensokyo.uk>
nix: update flake lock2025-12-11T23:39:55ZOphestracat@gensokyo.uk2025-12-11T23:39:55Zurn:sha1:ebc67bb8ada03750eee60ab58c945b4745f22af1
NixOS 25.11 introduces a crash in cage and an intermittent crash in foot.
Signed-off-by: Ophestra <cat@gensokyo.uk>
treewide: include PipeWire op and enforce PulseAudio check2025-12-07T23:53:04ZOphestracat@gensokyo.uk2025-12-07T23:03:50Zurn:sha1:87781c765844409226804157546753b84ef3c6b4
This fully replaces PulseAudio with PipeWire and enforces the PulseAudio check and error message. The pipewire-pulse daemon is handled in the NixOS module.
Closes #26.
Signed-off-by: Ophestra <cat@gensokyo.uk>
hst/grp_pwd: specify new uid format2025-11-03T23:24:41ZOphestracat@gensokyo.uk2025-11-03T23:00:37Zurn:sha1:cb9ebf0e1541c0e49380cda6d4c2d619a0e9933f
This leaves slots available for additional uid ranges in Rosa OS.
This breaks all existing installations! Users are required to fix ownership manually.
Closes #18.
Signed-off-by: Ophestra <cat@gensokyo.uk>
hst/container: optional runtime and tmpdir sharing2025-10-18T19:11:38ZOphestracat@gensokyo.uk2025-10-18T18:53:20Zurn:sha1:699c19e972a3cbcc714403aedffcb5ff74386cfc
Sharing and persisting these directories do not always make sense. Make it optional here.
Closes #16.
Signed-off-by: Ophestra <cat@gensokyo.uk>
internal/app/outcome: apply configured filesystems late2025-10-18T16:41:52ZOphestracat@gensokyo.uk2025-10-18T16:41:52Zurn:sha1:e47aebb7a0de9b3b9f0345db68ff0119e6cc12c0
This enables configured filesystems to cover system mount points.
Closes #8.
Signed-off-by: Ophestra <cat@gensokyo.uk>
internal/app/spruntime: emulate pam_systemd type2025-10-17T19:33:04ZOphestracat@gensokyo.uk2025-10-17T19:25:40Zurn:sha1:d4284c109d593fa1413a162734b3db5134c66d19
This sets XDG_SESSION_TYPE to the corresponding values specified in pam_systemd(8) according to enablements.
Signed-off-by: Ophestra <cat@gensokyo.uk>
test/sandbox: check extra writable paths2025-09-14T06:12:51ZOphestracat@gensokyo.uk2025-09-14T06:12:09Zurn:sha1:83c4f8b767c31734a7e465e49ee0e23487ac22ca
This is not always obvious from mountinfo.
Signed-off-by: Ophestra <cat@gensokyo.uk>