diff options
Diffstat (limited to 'hst/container.go')
| -rw-r--r-- | hst/container.go | 86 |
1 files changed, 86 insertions, 0 deletions
diff --git a/hst/container.go b/hst/container.go new file mode 100644 index 00000000..ca75c17b --- /dev/null +++ b/hst/container.go @@ -0,0 +1,86 @@ +package hst + +import ( + "time" + + "hakurei.app/container/check" +) + +// PrivateTmp is a private writable path in a hakurei container. +const PrivateTmp = "/.hakurei" + +// AbsPrivateTmp is a [check.Absolute] representation of [PrivateTmp]. +var AbsPrivateTmp = check.MustAbs(PrivateTmp) + +const ( + // WaitDelayDefault is used when WaitDelay has its zero value. + WaitDelayDefault = 5 * time.Second + // WaitDelayMax is used if WaitDelay exceeds its value. + WaitDelayMax = 30 * time.Second + + // IdentityMin is the minimum value of [Config.Identity]. This is enforced by cmd/hsu. + IdentityMin = 0 + // IdentityMax is the maximum value of [Config.Identity]. This is enforced by cmd/hsu. + IdentityMax = 9999 + + // ShimExitRequest is returned when the priv side process requests shim exit. + ShimExitRequest = 254 + // ShimExitOrphan is returned when the shim is orphaned before priv side delivers a signal. + ShimExitOrphan = 3 +) + +// ContainerConfig describes the container configuration to be applied to an underlying [container]. +type ContainerConfig struct { + // Container UTS namespace hostname. + Hostname string `json:"hostname,omitempty"` + + // Duration in nanoseconds to wait for after interrupting the initial process. + // Defaults to [WaitDelayDefault] if zero, or [WaitDelayMax] if greater than [WaitDelayMax]. + // Values lesser than zero is equivalent to zero, bypassing [WaitDelayDefault]. + WaitDelay time.Duration `json:"wait_delay,omitempty"` + + // Emit Flatpak-compatible seccomp filter programs. + SeccompCompat bool `json:"seccomp_compat,omitempty"` + // Allow ptrace and friends. + Devel bool `json:"devel,omitempty"` + // Allow userns creation and container setup syscalls. + Userns bool `json:"userns,omitempty"` + // Share host net namespace. + HostNet bool `json:"host_net,omitempty"` + // Share abstract unix socket scope. + HostAbstract bool `json:"host_abstract,omitempty"` + // Allow dangerous terminal I/O (faking input). + Tty bool `json:"tty,omitempty"` + // Allow multiarch. + Multiarch bool `json:"multiarch,omitempty"` + + // Initial process environment variables. + Env map[string]string `json:"env"` + + /* Map target user uid to privileged user uid in the container user namespace. + + Some programs fail to connect to dbus session running as a different uid, + this option works around it by mapping priv-side caller uid in container. */ + MapRealUID bool `json:"map_real_uid"` + + // Mount /dev/ from the init mount namespace as-is in the container mount namespace. + Device bool `json:"device,omitempty"` + + /* Container mount points. + + If the first element targets /, it is inserted early and excluded from path hiding. */ + Filesystem []FilesystemConfigJSON `json:"filesystem"` + + // String used as the username of the emulated user, validated against the default NAME_REGEX from adduser. + // Defaults to passwd name of target uid or chronos. + Username string `json:"username,omitempty"` + // Pathname of shell in the container filesystem to use for the emulated user. + Shell *check.Absolute `json:"shell"` + // Directory in the container filesystem to enter and use as the home directory of the emulated user. + Home *check.Absolute `json:"home"` + + // Pathname to executable file in the container filesystem. + Path *check.Absolute `json:"path,omitempty"` + // Final args passed to the initial program. + Args []string `json:"args"` +} |