ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Enforce exact recovery ownership before cold start

Browse source
This commit is contained in:
ms2k 2026-07-17 06:48:49 +09:00
commit 2bc5982a62
2 changed files with 1076 additions and 238 deletions
Download patch file Download diff file Expand all files Collapse all files

8
crates/lazaret-core/tests/schema_records.rs
View file

@ -457,14 +457,19 @@ fn complete_ownership(role: ParticipantRole, state: ParticipantState) -> Partici
ParticipantRole::Sandbox => ParticipantOwnership::Sandbox(SandboxOwnership {
container_id: Some(ContainerId::new(opaque(29))),
runtime_root: Some(HostPath::new(b"runtime".to_vec())),
runtime_root_identity: Some(mount()),
bundle_digest: Some(BundleDigest::new(opaque(43))),
host_coordinator: owned_process(30),
runtime_supervisor: owned_process(21),
attached_runsc: owned_process(44),
}),
ParticipantRole::Publication => ParticipantOwnership::Publication(PublicationOwnership {
staged_socket_path: Some(HostPath::new(b"staged-socket".to_vec())),
staged_identity_path: Some(HostPath::new(b"staged-identity".to_vec())),
socket_path: Some(HostPath::new(b"socket".to_vec())),
identity_path: Some(HostPath::new(b"identity".to_vec())),
socket_identity: Some(mount()),
identity_file_identity: Some(mount()),
}),
}
}
@ -558,6 +563,7 @@ fn participant_edge_snapshot(
ParticipantOwnership::Sandbox(SandboxOwnership {
container_id: Some(ContainerId::new(opaque(29))),
runtime_root: None,
runtime_root_identity: None,
bundle_digest: None,
host_coordinator: process_ownership,
runtime_supervisor: PersistedHostProcessOwnership::unassigned(),
@ -569,6 +575,7 @@ fn participant_edge_snapshot(
ParticipantOwnership::Sandbox(SandboxOwnership {
container_id: Some(ContainerId::new(opaque(29))),
runtime_root: None,
runtime_root_identity: None,
bundle_digest: None,
host_coordinator: owned_process(122),
runtime_supervisor: process_ownership,
@ -580,6 +587,7 @@ fn participant_edge_snapshot(
ParticipantOwnership::Sandbox(SandboxOwnership {
container_id: Some(ContainerId::new(opaque(29))),
runtime_root: None,
runtime_root_identity: None,
bundle_digest: None,
host_coordinator: owned_process(122),
runtime_supervisor: owned_process(123),

17
crates/lazaret-core/tests/schema_records/encoding.rs
View file

@ -375,6 +375,11 @@ fn every_schema_shape_round_trips_and_rejects_malformed_or_unknown_versions() {
SandboxOwnership {
container_id: Some(ContainerId::new(opaque(29))),
runtime_root: Some(HostPath::new(b"runtime".to_vec())),
runtime_root_identity: Some(MountIdentity {
mount_id: MountId::new(68),
device: DeviceId::new(69),
inode: InodeId::new(70),
}),
bundle_digest: Some(BundleDigest::new(opaque(66))),
host_coordinator: owned_process(30),
runtime_supervisor: owned_process(21),
@ -384,8 +389,20 @@ fn every_schema_shape_round_trips_and_rejects_malformed_or_unknown_versions() {
);
verify_shape(
PublicationOwnership {
staged_socket_path: Some(HostPath::new(b"staged-socket".to_vec())),
staged_identity_path: Some(HostPath::new(b"staged-identity".to_vec())),
socket_path: Some(HostPath::new(b"socket".to_vec())),
identity_path: Some(HostPath::new(b"identity".to_vec())),
socket_identity: Some(MountIdentity {
mount_id: MountId::new(71),
device: DeviceId::new(72),
inode: InodeId::new(73),
}),
identity_file_identity: Some(MountIdentity {
mount_id: MountId::new(74),
device: DeviceId::new(75),
inode: InodeId::new(76),
}),
},
&mut seen,
);