hakurei/test/sandbox/configuration.nix, branch developlow-level userspace tooling for Rosa OShttp://src.rosa.moe/hakurei/atom/test/sandbox/configuration.nix?h=develop2026-10-06T10:41:06Ztest/sandbox: migrate tests2026-10-06T10:41:06ZOphestracat@gensokyo.uk2026-10-03T16:05:10Zurn:sha1:a7383510fb05abc98b992240cb76ad4b6c598956
This significantly improves performance, removing overhead of nix,
python, and virtualisation. Running this in an unprivileged container
required patching the kernel, but since special runner setup was already
needed, that was an acceptable tradeoff.
Signed-off-by: Ophestra <cat@gensokyo.uk>
cmd/hakurei: rename app to run2026-03-28T07:48:26ZOphestracat@gensokyo.uk2026-03-28T07:43:02Zurn:sha1:b1ea3b4acf85365fd76c890f8b8852b5f95be5c1
The run command was a legacy holdover from very early days and is only useful for testing and demonstration these days. This change also renames it to exec.
Signed-off-by: Ophestra <cat@gensokyo.uk>
nix: update flake lock2025-12-11T23:39:55ZOphestracat@gensokyo.uk2025-12-11T23:39:55Zurn:sha1:ebc67bb8ada03750eee60ab58c945b4745f22af1
NixOS 25.11 introduces a crash in cage and an intermittent crash in foot.
Signed-off-by: Ophestra <cat@gensokyo.uk>
test/sandbox: create marker in /var/tmp2025-09-14T07:45:17ZOphestracat@gensokyo.uk2025-09-14T07:45:17Zurn:sha1:1cdc6b4246ac82adb0c9ed7620d3f7225f1a3e7f
This prepares the test suite for private TMPDIR.
Signed-off-by: Ophestra <cat@gensokyo.uk>
test/sandbox: bind /var/tmp writable2025-09-14T05:59:53ZOphestracat@gensokyo.uk2025-09-14T05:59:53Zurn:sha1:d0ddd7193407af4162312469f19bd02af4d4bce1
This makes it possible to place markers with private tmpdir.
Signed-off-by: Ophestra <cat@gensokyo.uk>
hst/fs: implement overlay fstype2025-08-14T19:00:55ZOphestracat@gensokyo.uk2025-08-14T18:30:51Zurn:sha1:9ed3ba85eaba4bc4bd12b290dc4daf00ffe159dc
This finally exposes overlay mounts in the high level hakurei API.
Signed-off-by: Ophestra <cat@gensokyo.uk>
nix: check config via hakurei2025-08-14T18:27:54ZOphestracat@gensokyo.uk2025-08-14T18:27:54Zurn:sha1:4433c993fae86634b813ee212803a84aaeedd374
This is unfortunately the only feasible way of doing this in nix.
Signed-off-by: Ophestra <cat@gensokyo.uk>
test/sandbox: check pd behaviour2025-07-31T18:27:02ZOphestracat@gensokyo.uk2025-07-31T17:11:19Zurn:sha1:987981df7313d0a121121be36f5c8cf86ffeacd1
Signed-off-by: Ophestra <cat@gensokyo.uk>
test/sandbox: verify seccomp on all test cases2025-07-08T19:21:35ZOphestracat@gensokyo.uk2025-07-08T18:47:16Zurn:sha1:e574042d765f135814c5afabaf24cb7109fab175
This change also makes seccomp hashes cross-platform.
Signed-off-by: Ophestra <cat@gensokyo.uk>
treewide: rename to hakurei2025-06-24T19:57:41ZOphestracat@gensokyo.uk2025-06-24T18:59:52Zurn:sha1:87e008d56de974947ebb99c2cc40b25d3c2cf43e
Fortify makes little sense for a container tool.
Signed-off-by: Ophestra <cat@gensokyo.uk>