aboutsummaryrefslogtreecommitdiffhomepage
path: root/container
AgeCommit message (Collapse)Author
2026-05-04container/initoverlay: configure via fsconfigOphestra
This works around the page size limit at the cost of negligible performance regressions. Closes #34. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-05-03container: reject strings larger than a pageOphestra
The vfs stores these values in a page obtained via GFP, and silently stops copying once the page is filled. This check prevents confusing behaviour in such cases. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-04-10internal/landlock: relocate from package containerOphestra
This is not possible to use directly, so remove it from the public API. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-04-10container: unexport PR_SET_NO_NEW_PRIVS wrapperOphestra
This is subtle to use correctly. It also does not make sense as part of the container API. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-04-07container: do not set static deadlineOphestra
This usually ends up in the buffer, or completes well before the deadline, however this can still timeout on a very slow system. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-04-07internal/params: relocate from package containerOphestra
This does not make sense as part of the public API, so make it internal. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-04-07container: remove setup pipe helperOphestra
The API forces use of finalizer to close the read end of the setup pipe, which is no longer considered acceptable. Exporting this as part of package container also imposes unnecessary maintenance burden. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-04-07all: optionally forbid degrading in testsOphestra
This enables transparently degradable tests to be forced on in environments known to support them. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-04-07container: transparently degrade landlock in testsOphestra
Explicitly requiring landlock in tests will be supported in a future change. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-04-07container: skip landlock on hostnetOphestra
This overlaps with net namespace, so can be skipped without degrading security. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-04-05container/init: ignore finished processOphestra
This is not considered an error, if the process finishes while the signal is being delivered. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-04-03container: remove test timeoutsOphestra
These timeouts are no longer useful, and causes spurious test failures under load. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-30all: use filepathOphestra
This makes package check portable, and removes nonportable behaviour from package pkg, pipewire, and system. All other packages remain nonportable due to their nature. No latency increase was observed due to this change on amd64 and arm64 linux. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-30internal/netlink: set receive buffer sizeOphestra
This is done by both systemd sd-device and AOSP ueventd to improve robustness. Rosa OS will still handle ENOBUFS via coldboot but a big buffer should mitigate this as well. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-25internal/netlink: wrap netpoll via contextOphestra
This removes netpoll boilerplate for the most common use case. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-17internal/stub: move from containerOphestra
This package solves a very specific stubbing use case, in a less than elegant manner. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-17fhs: move from containerOphestra
This package is not container-specific. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-17ext: move syscall wrappers from containerOphestra
These are generally useful, and none of them are container-specific. Syscalls subtle to use and requiring container-specific setup remains in container. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-17check: move from containerOphestra
This package is not container specific, and widely used across the project. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-17vfs: move from containerOphestra
This package is not container-specific. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-17container: set CLOEXEC via close_rangeOphestra
This is guarded behind the close_range build tag for now. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-17ext: integer limit valuesOphestra
For portably using C integers without cgo. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-17all: remove deprecated packagesOphestra
Closes #24. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-17ext: isolate from container/stdOphestra
These are too general to belong in the container package. This targets the v0.4 release to reduce the wrapper maintenance burden. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-16container: use new netlink implementationOphestra
This is adapted from the container netlink implementation and is much more reusable. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-12container: expose priority and SCHED_OTHER policyOphestra
The more explicit API removes the arbitrary limit preventing use of SCHED_OTHER (referred to as SCHED_NORMAL in the kernel). This change also exposes priority value to set. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-11container: use policy name in log messageOphestra
This is more helpful than having the user resolve the integer. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-11container: move scheduler policy constants to stdOphestra
This avoids depending on cgo. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-10go: 1.26Ophestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-09container: sched policy string representationOphestra
This also uses priority obtained via sched_get_priority_min, and improves bounds checking. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-02-28container/std: rename seccomp typesOphestra
Aliases will be kept until 0.4. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-02-28container: use /proc/self/exe directlyOphestra
This is a more reliable form of pathname to self and also cheaper than os.Executable. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-02-28container: improve documentationOphestra
This change removes inconsistencies collected over time in this package. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-02-26container: set scheduling policyOphestra
This is thread-directed so cannot be done externally. The glibc wrapper exposes this behaviour so most multithreaded programs using this is straight up incorrect. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-02-17container/initplace: return nil for createTemp error injectionOphestra
This matches os package behaviour, and avoids adding the cleanup. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-02-08container: ignore uninterpreted sourceOphestra
These can be set to anything by the distribution. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-02-08container: strip host-dependent opts in test casesOphestra
This change also improves plumbing for stripping options. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-02-08container: add riscv64 constantsOphestra
This target is unlikely to become viable any time soon. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-31container: fix host-dependent test casesOphestra
These are not fully controlled by hakurei and may change depending on host configuration. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-19internal/rosa: GNU make artifactOphestra
This compiles GNU make from source. This is unfortunately required by many programs, but is a cure dependency only. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-11container/check: return error backed by string typeOphestra
The struct turned out not necessary during initial implementation but was not unwrapped into its single string field. This change replaces it with the underlying string and removes the indirection. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-11container/check: intern absolute pathnamesOphestra
This improves performance in heavy users like internal/pkg. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-11container/init: configure interface loOphestra
This enables loopback networking when owning the net namespace. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-12-27container: optionally allow orphanOphestra
This is required for the typical daemonise use case. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-12-14container: sync stubbed wait4 loop after notifyOphestra
This ensures consistent state observed by wait4 loop when running against stub. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-12-09container: load initial process started before syscallOphestra
This avoids a race between returning from syscall and checking the state. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-12-08container/initdaemon: copy wstatus from wait4 loopOphestra
Due to the special nature of the init process, direct use of wait outside the wait4 loop is racy. This change copies the wstatus from wait4 loop state instead. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-12-08container: spin instead of block on wait4 ECHILDOphestra
Blocking prevents further wait4 processing causing ops to never receive their signals. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-12-08container: improve error message fallbackOphestra
This now falls back to message.Error if no other concrete type is matched. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-12-08container: friendlier error message for op timing outOphestra
This includes the string for the failing op which helps with troubleshooting. Signed-off-by: Ophestra <cat@gensokyo.uk>