diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-07-01 20:23:33 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-07-01 22:11:32 +0900 |
| commit | 1a8840bebc673672235b6e10b1b9386f24751757 (patch) | |
| tree | d1e6772bfd685e2162d047e3640bd3ee55c1a1f7 /internal/app/instance | |
| parent | 1fb453dffe4c83866fedfa4590be30ec65e815ff (diff) | |
sandbox/seccomp: resolve rules natively
This enables loading syscall filter policies from external cross-platform config files.
This also removes a significant amount of C code.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'internal/app/instance')
| -rw-r--r-- | internal/app/instance/common/container.go | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/internal/app/instance/common/container.go b/internal/app/instance/common/container.go index 567a8aa7..6a32e9a8 100644 --- a/internal/app/instance/common/container.go +++ b/internal/app/instance/common/container.go @@ -27,8 +27,9 @@ func NewContainer(s *hst.ContainerConfig, os sys.State, uid, gid *int) (*sandbox } container := &sandbox.Params{ - Hostname: s.Hostname, - Seccomp: s.Seccomp, + Hostname: s.Hostname, + SeccompFlags: s.SeccompFlags, + SeccompPresets: s.SeccompPresets, } { @@ -37,7 +38,7 @@ func NewContainer(s *hst.ContainerConfig, os sys.State, uid, gid *int) (*sandbox } if s.Multiarch { - container.Seccomp |= seccomp.FilterMultiarch + container.SeccompFlags |= seccomp.AllowMultiarch } if s.Devel { |