aboutsummaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)Author
2025-03-21sandbox: resolve inverted flags in opOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-21test/sandbox: rename misleading bind destinationOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-21test/sandbox: check type handling host_passthroughOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-21sandbox/vfs: count mountinfo entriesOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-21sandbox/vfs: implement proc_pid_mountinfo(5) parserOphestra
Test cases are mostly taken from util-linux. This implementation is more correct and slightly faster than the one found in github:kubernetes/utils. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-18sandbox: prepare ops earlyOphestra
Some setup code needs to run in host root. This change allows that to happen. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: pass cmd to cancel functionOphestra
This is not usually in scope otherwise. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: place files with contentOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: create directoriesOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox/mount: pass absolute pathOphestra
This should never be used unless there is a good reason to, like using a file in the intermediate root. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: cancel process on serve errorOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: rename params structOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17internal/sys: wrap getuid/getgidOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: create symlinksOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox/init: fail early on nil opOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox/mount: rename device flagOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: mount container /dev/mqueueOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: unwrap path stringOphestra
Mount proc and dev takes no additional parameters. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox/seccomp: check for both partial read outcomesOphestra
This eliminates intermittent test failures. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17nix: clean up flake outputsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: move out of internalOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: move params setup functionsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: wrap fmsg interfaceOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17seccomp: install output atomicallyOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17dbus: run in native sandboxOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17ldd: always copy stderrOphestra
Dropping the buffer on success is unhelpful and could hide some useful information. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17ldd: mount /proc in containerOphestra
This covers host /proc. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16test: raise timeoutOphestra
Native container tooling is severely slowed down by race detector. Raise timeout so it reliably completes. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16sandbox: check command function pointerOphestra
Setting default CommandContext on initialisation is somewhat of a footgun. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16helper: implement native container backendOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16helper: raise WaitDelay during testsOphestra
Helper runs very slowly with race detector. This prevents it from timing out. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16test: run go tests with race detectorOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16ldd: lib paths resolve functionOphestra
This is what always happens right after a ldd call, so implement it here. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16helper/stub: copy args to stderrOphestra
Some helpers are implemented via go test itself in tests, and as a result stdout gets clobbered. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16sandbox: return on zero length opsOphestra
This dodges potentially confusing behaviour where init fails due to Ops being clobbered during transfer. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16helper: eliminate commandContext replacementOphestra
This is done more cleanly by modifying Args in cmdF. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-15sandbox/init: early params nil checkOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-15sandbox: return error on doubled startOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-15sandbox: expose cancel behaviourOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-15helper: expose extra files to directOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-15helper: combine helper ipc setupOphestra
The two-step args call is no longer necessary since stat is passed on initialisation. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-15helper: rearrange initialisation argsOphestra
This improves consistency across two different helper implementations. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-15helper: move process wrapper to directOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-15helper: clean up interfaceOphestra
The helper interface was messy due to odd context acquisition order. That has changed, so this cleans it up. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14helper/proc: pass extra files and startOphestra
For integration with native container tooling. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14seccomp: move out of helperOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14helper: embed context on creationOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14ldd: run in native sandboxOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14sandbox: write uid/gid map as initOphestra
This avoids PR_SET_DUMPABLE in the parent process. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14sandbox: invert seccomp ruleset defaultsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>