From 699c19e972a3cbcc714403aedffcb5ff74386cfc Mon Sep 17 00:00:00 2001
From: Ophestra <cat@gensokyo.uk>
Date: Sun, 19 Oct 2025 03:53:20 +0900
Subject: hst/container: optional runtime and tmpdir sharing

Sharing and persisting these directories do not always make sense. Make it optional here.

Closes #16.

Signed-off-by: Ophestra <cat@gensokyo.uk>
---
 cmd/hakurei/command.go      | 13 +++++++++++++
 cmd/hakurei/command_test.go |  6 +++++-
 cmd/hakurei/print_test.go   | 12 +++++++++---
 cmd/hpkg/app.go             |  1 +
 4 files changed, 28 insertions(+), 4 deletions(-)

(limited to 'cmd')

diff --git a/cmd/hakurei/command.go b/cmd/hakurei/command.go
index 232b3234..72152537 100644
--- a/cmd/hakurei/command.go
+++ b/cmd/hakurei/command.go
@@ -81,6 +81,8 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 			flagHomeDir  string
 			flagUserName string
 
+			flagPrivateRuntime, flagPrivateTmpdir bool
+
 			flagWayland, flagX11, flagDBus, flagPulse bool
 		)
 
@@ -211,6 +213,13 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 				}
 			}
 
+			if !flagPrivateRuntime {
+				config.Container.Flags |= hst.FShareRuntime
+			}
+			if !flagPrivateTmpdir {
+				config.Container.Flags |= hst.FShareTmpdir
+			}
+
 			// parse D-Bus config file from flags if applicable
 			if flagDBus {
 				if flagDBusConfigSession == "builtin" {
@@ -264,6 +273,10 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 				"Container home directory").
 			Flag(&flagUserName, "u", command.StringFlag("chronos"),
 				"Passwd user name within sandbox").
+			Flag(&flagPrivateRuntime, "private-runtime", command.BoolFlag(false),
+				"Do not share XDG_RUNTIME_DIR between containers under the same identity").
+			Flag(&flagPrivateTmpdir, "private-tmpdir", command.BoolFlag(false),
+				"Do not share TMPDIR between containers under the same identity").
 			Flag(&flagWayland, "wayland", command.BoolFlag(false),
 				"Enable connection to Wayland via security-context-v1").
 			Flag(&flagX11, "X", command.BoolFlag(false),
diff --git a/cmd/hakurei/command_test.go b/cmd/hakurei/command_test.go
index 66960d9f..e489291d 100644
--- a/cmd/hakurei/command_test.go
+++ b/cmd/hakurei/command_test.go
@@ -36,7 +36,7 @@ Commands:
 		},
 		{
 			"run", []string{"run", "-h"}, `
-Usage:	hakurei run [-h | --help] [--dbus-config <value>] [--dbus-system <value>] [--mpris] [--dbus-log] [--id <value>] [-a <int>] [-g <value>] [-d <value>] [-u <value>] [--wayland] [-X] [--dbus] [--pulse] COMMAND [OPTIONS]
+Usage:	hakurei run [-h | --help] [--dbus-config <value>] [--dbus-system <value>] [--mpris] [--dbus-log] [--id <value>] [-a <int>] [-g <value>] [-d <value>] [-u <value>] [--private-runtime] [--private-tmpdir] [--wayland] [-X] [--dbus] [--pulse] COMMAND [OPTIONS]
 
 Flags:
   -X	Enable direct connection to X11
@@ -58,6 +58,10 @@ Flags:
     	Reverse-DNS style Application identifier, leave empty to inherit instance identifier
   -mpris
     	Allow owning MPRIS D-Bus path, has no effect if custom config is available
+  -private-runtime
+    	Do not share XDG_RUNTIME_DIR between containers under the same identity
+  -private-tmpdir
+    	Do not share TMPDIR between containers under the same identity
   -pulse
     	Enable direct connection to PulseAudio
   -u string
diff --git a/cmd/hakurei/print_test.go b/cmd/hakurei/print_test.go
index da2db0dc..caea8995 100644
--- a/cmd/hakurei/print_test.go
+++ b/cmd/hakurei/print_test.go
@@ -332,7 +332,9 @@ App
       "tty": true,
       "multiarch": true,
       "map_real_uid": true,
-      "device": true
+      "device": true,
+      "share_runtime": true,
+      "share_tmpdir": true
     }
   },
   "time": "1970-01-01T00:00:00.000000009Z"
@@ -482,7 +484,9 @@ App
     "tty": true,
     "multiarch": true,
     "map_real_uid": true,
-    "device": true
+    "device": true,
+    "share_runtime": true,
+    "share_tmpdir": true
   }
 }
 `, true},
@@ -692,7 +696,9 @@ func TestPrintPs(t *testing.T) {
         "tty": true,
         "multiarch": true,
         "map_real_uid": true,
-        "device": true
+        "device": true,
+        "share_runtime": true,
+        "share_tmpdir": true
       }
     },
     "time": "1970-01-01T00:00:00.000000009Z"
diff --git a/cmd/hpkg/app.go b/cmd/hpkg/app.go
index 350eaaa7..17179dce 100644
--- a/cmd/hpkg/app.go
+++ b/cmd/hpkg/app.go
@@ -130,6 +130,7 @@ func (app *appInfo) toHst(pathSet *appPathSet, pathname *check.Absolute, argv []
 	if app.Multiarch {
 		config.Container.Flags |= hst.FMultiarch
 	}
+	config.Container.Flags |= hst.FShareRuntime | hst.FShareTmpdir
 	return config
 }
 
-- 
cgit v1.3.1