aboutsummaryrefslogtreecommitdiffhomepage
diff options
context:
space:
mode:
Diffstat
-rw-r--r--cmd/hakurei/print.go4
-rw-r--r--cmd/hakurei/print_test.go34
-rw-r--r--hst/container.go3
-rw-r--r--hst/template.go2
-rw-r--r--hst/template_test.go10
-rw-r--r--internal/app/app_nixos_linux_test.go2
-rw-r--r--internal/app/container_linux.go2
-rw-r--r--internal/app/seal_linux.go4
8 files changed, 28 insertions, 33 deletions
diff --git a/cmd/hakurei/print.go b/cmd/hakurei/print.go
index 807831c4..1169d10f 100644
--- a/cmd/hakurei/print.go
+++ b/cmd/hakurei/print.go
@@ -114,10 +114,6 @@ func printShowInstance(
}
t.Printf(" Etc:\t%s\n", etc)
- if len(container.Cover) > 0 {
- t.Printf(" Cover:\t%s\n", strings.Join(container.Cover, " "))
- }
-
t.Printf(" Path:\t%s\n", config.Path)
}
if len(config.Args) > 0 {
diff --git a/cmd/hakurei/print_test.go b/cmd/hakurei/print_test.go
index 7979fb65..0a4e91ba 100644
--- a/cmd/hakurei/print_test.go
+++ b/cmd/hakurei/print_test.go
@@ -44,11 +44,11 @@ func Test_printShowInstance(t *testing.T) {
Flags: userns devel net device tty mapuid autoetc
Root: /var/lib/hakurei/base/org.debian (2)
Etc: /etc
- Cover: /var/run/nscd
Path: /run/current-system/sw/bin/chromium
Arguments: chromium --ignore-gpu-blocklist --disable-smooth-scrolling --enable-features=UseOzonePlatform --ozone-platform=wayland
Filesystem
+ w+tmpfs:/tmp
+/nix/store
+/run/current-system
+/run/opengl-driver
@@ -124,11 +124,11 @@ App
Flags: userns devel net device tty mapuid autoetc
Root: /var/lib/hakurei/base/org.debian (2)
Etc: /etc
- Cover: /var/run/nscd
Path: /run/current-system/sw/bin/chromium
Arguments: chromium --ignore-gpu-blocklist --disable-smooth-scrolling --enable-features=UseOzonePlatform --ozone-platform=wayland
Filesystem
+ w+tmpfs:/tmp
+/nix/store
+/run/current-system
+/run/opengl-driver
@@ -276,6 +276,11 @@ App
"device": true,
"filesystem": [
{
+ "dst": "/tmp",
+ "src": "tmpfs",
+ "write": true
+ },
+ {
"src": "/nix/store"
},
{
@@ -307,10 +312,7 @@ App
"auto_root": "/var/lib/hakurei/base/org.debian",
"root_flags": 2,
"etc": "/etc",
- "auto_etc": true,
- "cover": [
- "/var/run/nscd"
- ]
+ "auto_etc": true
}
},
"time": "1970-01-01T00:00:00.000000009Z"
@@ -406,6 +408,11 @@ App
"device": true,
"filesystem": [
{
+ "dst": "/tmp",
+ "src": "tmpfs",
+ "write": true
+ },
+ {
"src": "/nix/store"
},
{
@@ -437,10 +444,7 @@ App
"auto_root": "/var/lib/hakurei/base/org.debian",
"root_flags": 2,
"etc": "/etc",
- "auto_etc": true,
- "cover": [
- "/var/run/nscd"
- ]
+ "auto_etc": true
}
}
`},
@@ -590,6 +594,11 @@ func Test_printPs(t *testing.T) {
"device": true,
"filesystem": [
{
+ "dst": "/tmp",
+ "src": "tmpfs",
+ "write": true
+ },
+ {
"src": "/nix/store"
},
{
@@ -621,10 +630,7 @@ func Test_printPs(t *testing.T) {
"auto_root": "/var/lib/hakurei/base/org.debian",
"root_flags": 2,
"etc": "/etc",
- "auto_etc": true,
- "cover": [
- "/var/run/nscd"
- ]
+ "auto_etc": true
}
},
"time": "1970-01-01T00:00:00.000000009Z"
diff --git a/hst/container.go b/hst/container.go
index 9ca14a8b..ebce07b9 100644
--- a/hst/container.go
+++ b/hst/container.go
@@ -69,9 +69,6 @@ type (
Etc string `json:"etc,omitempty"`
// automatically set up /etc symlinks
AutoEtc bool `json:"auto_etc"`
-
- // cover these paths or create them if they do not already exist
- Cover []string `json:"cover"`
}
// FilesystemConfig is an abstract representation of a bind mount.
diff --git a/hst/template.go b/hst/template.go
index 391e58e2..5758462e 100644
--- a/hst/template.go
+++ b/hst/template.go
@@ -78,6 +78,7 @@ func Template() *Config {
"GOOGLE_DEFAULT_CLIENT_SECRET": "OTJgUOQcT7lO7GsGZq2G4IlT",
},
Filesystem: []*FilesystemConfig{
+ {Dst: "/tmp", Src: SourceTmpfs, Write: true},
{Src: "/nix/store"},
{Src: "/run/current-system"},
{Src: "/run/opengl-driver"},
@@ -91,7 +92,6 @@ func Template() *Config {
RootFlags: container.BindWritable,
Etc: "/etc",
AutoEtc: true,
- Cover: []string{"/var/run/nscd"},
},
}
}
diff --git a/hst/template_test.go b/hst/template_test.go
index 7f0caa7d..02ec7748 100644
--- a/hst/template_test.go
+++ b/hst/template_test.go
@@ -98,6 +98,11 @@ func TestTemplate(t *testing.T) {
"device": true,
"filesystem": [
{
+ "dst": "/tmp",
+ "src": "tmpfs",
+ "write": true
+ },
+ {
"src": "/nix/store"
},
{
@@ -129,10 +134,7 @@ func TestTemplate(t *testing.T) {
"auto_root": "/var/lib/hakurei/base/org.debian",
"root_flags": 2,
"etc": "/etc",
- "auto_etc": true,
- "cover": [
- "/var/run/nscd"
- ]
+ "auto_etc": true
}
}`
diff --git a/internal/app/app_nixos_linux_test.go b/internal/app/app_nixos_linux_test.go
index 303d535d..c11fbd81 100644
--- a/internal/app/app_nixos_linux_test.go
+++ b/internal/app/app_nixos_linux_test.go
@@ -28,7 +28,6 @@ var testCasesNixos = []sealTestCase{
{Src: "/sys/block"}, {Src: "/sys/bus"}, {Src: "/sys/class"}, {Src: "/sys/dev"}, {Src: "/sys/devices"},
{Src: "/run/opengl-driver", Must: true}, {Src: "/dev/dri", Device: true},
},
- Cover: []string{"/var/run/nscd"},
},
SystemBus: &dbus.Config{
Talk: []string{"org.bluez", "org.freedesktop.Avahi", "org.freedesktop.UPower"},
@@ -143,7 +142,6 @@ var testCasesNixos = []sealTestCase{
Place(hst.Tmp+"/pulse-cookie", nil).
Bind("/tmp/hakurei.1971/8e2c76b066dabe574cf073bdb46eb5c1/bus", "/run/user/1971/bus", 0).
Bind("/tmp/hakurei.1971/8e2c76b066dabe574cf073bdb46eb5c1/system_bus_socket", "/run/dbus/system_bus_socket", 0).
- Tmpfs("/var/run/nscd", 8192, 0755).
Remount("/", syscall.MS_RDONLY),
SeccompPresets: seccomp.PresetExt | seccomp.PresetDenyTTY | seccomp.PresetDenyDevel,
HostNet: true,
diff --git a/internal/app/container_linux.go b/internal/app/container_linux.go
index 09909d83..ce3a5154 100644
--- a/internal/app/container_linux.go
+++ b/internal/app/container_linux.go
@@ -40,7 +40,7 @@ func newContainer(s *hst.ContainerConfig, os sys.State, prefix string, uid, gid
}
{
- ops := make(container.Ops, 0, preallocateOpsCount+len(s.Filesystem)+len(s.Link)+len(s.Cover))
+ ops := make(container.Ops, 0, preallocateOpsCount+len(s.Filesystem)+len(s.Link))
params.Ops = &ops
}
diff --git a/internal/app/seal_linux.go b/internal/app/seal_linux.go
index b25b5c4f..6bf6c092 100644
--- a/internal/app/seal_linux.go
+++ b/internal/app/seal_linux.go
@@ -474,10 +474,6 @@ func (seal *outcome) finalise(ctx context.Context, sys sys.State, config *hst.Co
}
}
- for _, dest := range config.Container.Cover {
- seal.container.Tmpfs(dest, 1<<13, 0755)
- }
-
// mount root read-only as the final setup Op
seal.container.Remount("/", syscall.MS_RDONLY)
generated by cgit v1.3.1 (git 2.54.0) at 2026-08-30 04:16:11 +0000