aboutsummaryrefslogtreecommitdiffhomepage
path: root/fst/sandbox.go
AgeCommit message (Collapse)Author
2025-04-13fst: improve configOphestra
The config struct more or less "grew" to what it is today. This change moves things around to make more sense and fixes nonsensical comments describing obsolete behaviour. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-04-12app/instance: wrap internal implementationOphestra
This reduces the scope of the fst package, which was growing questionably large. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-04-11fst: mount passthrough /dev writableOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-04-11fst: rename device fieldOphestra
Dev is very ambiguous. Rename it here alongside upcoming config changes. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-04-11sandbox: relative autoetc linksOphestra
This allows nested containers to use autoetc, and increases compatibility with other implementations. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-04-10sandbox: implement autoetc as setup opOphestra
This significantly reduces setup op count and the readdir call now happens in the context of the init process. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-04-08sandbox/seccomp: rename flag type and constantsOphestra
The names are ambiguous. Rename them to make more sense. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-30fst: set multiarch bitOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-25fst/sandbox: do not create /etc in advanceOphestra
This is now handled by the setup op. This also gets rid of the hardcoded /etc path. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-25app: run in native sandboxOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17internal/sys: wrap getuid/getgidOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-19app: remove share methodOphestra
This is yet another implementation detail from before system.I, getting rid of this vastly cuts down on redundant seal state. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-18app: separate interface from implementationOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-18fst: declare wrappers for sandbox configOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-18sys: rename from linuxOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-16fmsg: implement suspend in writerOphestra
This removes the requirement to call fmsg.Exit on every exit path, and enables direct use of the "log" package. However, fmsg.BeforeExit is still encouraged when possible to catch exit on suspended output. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-22helper/bwrap: integrate seccomp into helper interfaceOphestra
This makes API usage much cleaner, and encapsulates all bwrap arguments in argsWt. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-15fst: hide sockets exposed via FilesystemOphestra
This is mostly useful for permissive defaults. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-15fst: move sandbox struct to separate fileOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>