ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Own the patched runsc artifact and bind recovery identity

Browse source
This commit is contained in:
ms2k 2026-07-26 18:01:03 +09:00
commit 2c420012bd
1 changed files with 1967 additions and 130 deletions
Download patch file Download diff file Expand all files Collapse all files

48
crates/lazaret-host-coordinator/src/runtime/tests.rs
View file

@ -3,7 +3,8 @@ use std::path::Path;
use lazaret_core::identity::{
BootId, ConfigurationFingerprint, CoordinatorId, DomainId, HostPidLocator, NetworkSidecarId,
PidfsDeviceId, PidfsInodeId, PidfsProcessAuthorityV1, ProcessStartTimeTicks, SandboxId,
PidfsDeviceId, PidfsInodeId, PidfsProcessAuthorityV1, ProcessStartTimeTicks, RunscBuildId,
RunscDigest, SandboxId,
};
use lazaret_core::records::{Domain, DurableDecision, Generation};
use lazaret_linux::filesystem::{current_mount_identity, try_exclusive_flock};
@ -87,14 +88,16 @@ fn sandbox_staging_readiness_and_release_preserve_exact_ownership() {
let store = store(&directory);
let coordinator = SandboxCoordinator::new(&store);
coordinator
.begin_intent(
generation().generation_id,
ContainerId::new(bytes(6)),
directory.path(),
current_mount_identity(directory.path()).unwrap(),
BundleDigest::new(bytes(7)),
process(100),
)
.begin_intent(SandboxIntent {
generation_id: generation().generation_id,
container_id: ContainerId::new(bytes(6)),
runtime_root: directory.path(),
runtime_root_identity: current_mount_identity(directory.path()).unwrap(),
bundle_digest: BundleDigest::new(bytes(7)),
runsc_build_id: RunscBuildId::new(bytes(8)),
runsc_digest: RunscDigest::new(bytes(8)),
host_coordinator: process(100),
})
.unwrap();
let rs = staged(
HostProcessOwnershipSlot::SandboxRuntimeSupervisor,
@ -123,9 +126,14 @@ fn sandbox_staging_readiness_and_release_preserve_exact_ownership() {
ownership.runtime_supervisor,
PersistedHostProcessOwnership::committed(process(101))
);
assert!(ownership.attached_runsc.is_staged());
assert_eq!(
ownership.attached_runsc,
PersistedHostProcessOwnership::staged(process(102))
ownership.attached_runsc.authoritative_pidfs().unwrap(),
&process(102)
);
assert_eq!(
ownership.attached_runsc.runsc_identity(),
Some((RunscBuildId::new(bytes(8)), RunscDigest::new(bytes(8))))
);
coordinator.commit_ready(runsc).unwrap();
assert_eq!(
@ -152,14 +160,16 @@ fn mismatched_and_skipped_acquisition_boundaries_refuse_without_state_change() {
let store = store(&directory);
let coordinator = SandboxCoordinator::new(&store);
coordinator
.begin_intent(
generation().generation_id,
ContainerId::new(bytes(6)),
directory.path(),
current_mount_identity(directory.path()).unwrap(),
BundleDigest::new(bytes(7)),
process(100),
)
.begin_intent(SandboxIntent {
generation_id: generation().generation_id,
container_id: ContainerId::new(bytes(6)),
runtime_root: directory.path(),
runtime_root_identity: current_mount_identity(directory.path()).unwrap(),
bundle_digest: BundleDigest::new(bytes(7)),
runsc_build_id: RunscBuildId::new(bytes(8)),
runsc_digest: RunscDigest::new(bytes(8)),
host_coordinator: process(100),
})
.unwrap();
let runsc = staged(HostProcessOwnershipSlot::SandboxAttachedRunsc, process(102));
assert!(coordinator.stage_attached_runsc(runsc).is_err());