ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Own the patched runsc artifact and bind recovery identity

Browse source
This commit is contained in:
ms2k 2026-07-26 18:01:03 +09:00
commit 2c420012bd
1 changed files with 1967 additions and 130 deletions
Download patch file Download diff file Expand all files Collapse all files

28
crates/lazaret-host-coordinator/src/bootstrap.rs
View file

@ -4,7 +4,9 @@ use std::sync::Arc;
use std::sync::Mutex;
use lazaret_core::configuration::ResolvedDomainConfiguration;
use lazaret_core::identity::{BundleDigest, ContainerId, HostPath, MountIdentity};
use lazaret_core::identity::{
BundleDigest, ContainerId, HostPath, MountIdentity, RunscBuildId, RunscDigest,
};
use lazaret_core::network::CanonicalDerivedNetworkPolicy;
use lazaret_core::records::Session;
use lazaret_core::records::{
@ -33,7 +35,7 @@ use crate::lifecycle::{
};
use crate::network::NetworkCoordinator;
use crate::runtime::{
AwaitingAttachedRunsc, CommittedSandboxRuntime, SandboxCoordinator,
AwaitingAttachedRunsc, CommittedSandboxRuntime, SandboxCoordinator, SandboxIntent,
StateAnchorAbsenceObservation,
};
use crate::state_anchor::{StateAnchorCoordinator, StateAnchorReleaseAuthority};
@ -74,6 +76,9 @@ pub struct BootstrapPlan<'a> {
pub container_id: ContainerId,
pub runtime_root: PathBuf,
pub bundle_digest: BundleDigest,
pub runsc_program: PathBuf,
pub runsc_build_id: RunscBuildId,
pub runsc_digest: RunscDigest,
pub invoking_uid: u32,
pub non_interactive_executor: Arc<dyn NonInteractiveSessionExecutor>,
pub interactive_executor: Arc<dyn InteractiveSessionExecutor>,
@ -263,17 +268,20 @@ impl<'a> CoordinatorLifecycleAdapter<'a> {
fn start_runtime_supervisor(&mut self) -> Result<(), LifecycleServiceError> {
let sandbox = self.sandbox();
sandbox
.begin_intent(
self.plan.generation_identity.generation_id,
self.plan.container_id,
&self.plan.runtime_root,
self.plan
.begin_intent(SandboxIntent {
generation_id: self.plan.generation_identity.generation_id,
container_id: self.plan.container_id,
runtime_root: &self.plan.runtime_root,
runtime_root_identity: self
.plan
.runtime_staging
.runsc_root_identity()
.map_err(failure)?,
self.plan.bundle_digest,
current_process_identity().map_err(failure)?,
)
bundle_digest: self.plan.bundle_digest,
runsc_build_id: self.plan.runsc_build_id,
runsc_digest: self.plan.runsc_digest,
host_coordinator: current_process_identity().map_err(failure)?,
})
.map_err(failure)?;
let launch = &self.plan.runtime_launch;
self.awaiting_runtime = Some(