From 15011c41731157fafd0d317fc273490eba43bdf5 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Sun, 13 Apr 2025 03:46:07 +0900 Subject: app/instance/common: optimise ops allocation Signed-off-by: Ophestra --- internal/app/instance/common/container.go | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) (limited to 'internal/app/instance') diff --git a/internal/app/instance/common/container.go b/internal/app/instance/common/container.go index 370997aa..cb3eb596 100644 --- a/internal/app/instance/common/container.go +++ b/internal/app/instance/common/container.go @@ -6,7 +6,6 @@ import ( "io/fs" "maps" "path" - "slices" "syscall" "git.gensokyo.uk/security/fortify/dbus" @@ -16,6 +15,10 @@ import ( "git.gensokyo.uk/security/fortify/sandbox/seccomp" ) +// in practice there should be less than 30 entries added by the runtime; +// allocating slightly more as a margin for future expansion +const preallocateOpsCount = 1 << 5 + // NewContainer initialises [sandbox.Params] via [fst.ContainerConfig]. // Note that remaining container setup must be queued by the caller. func NewContainer(s *fst.ContainerConfig, os sys.State, uid, gid *int) (*sandbox.Params, map[string]string, error) { @@ -25,19 +28,18 @@ func NewContainer(s *fst.ContainerConfig, os sys.State, uid, gid *int) (*sandbox container := &sandbox.Params{ Hostname: s.Hostname, - Ops: new(sandbox.Ops), Seccomp: s.Seccomp, } + { + ops := make(sandbox.Ops, 0, preallocateOpsCount+len(s.Filesystem)+len(s.Link)+len(s.Cover)) + container.Ops = &ops + } + if s.Multiarch { container.Seccomp |= seccomp.FilterMultiarch } - /* this is only 4 KiB of memory on a 64-bit system, - permissive defaults on NixOS results in around 100 entries - so this capacity should eliminate copies for most setups */ - *container.Ops = slices.Grow(*container.Ops, 1<<8) - if s.Devel { container.Flags |= sandbox.FAllowDevel } -- cgit v1.3.1