ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Own the patched runsc artifact and bind recovery identity

Browse source
This commit is contained in:
ms2k 2026-07-26 18:01:03 +09:00
commit 2c420012bd
3 changed files with 1967 additions and 130 deletions
Download patch file Download diff file Expand all files Collapse all files

7
crates/lazaret-host-coordinator/tests/cold_start.rs
View file

@ -8,7 +8,8 @@ use std::sync::Arc;
use lazaret_core::configuration::{ConfigurationLoadRequest, load_trusted_configuration};
use lazaret_core::identity::{
ContainerId, CoordinatorId, DeviceId, GenerationId, HostPath, IdMapDigest, InodeId, PolicyId,
PreparedArtifactId, SandboxId, SelectedManifestDigest, SourceIdentity,
PreparedArtifactId, RunscBuildId, RunscDigest, SandboxId, SelectedManifestDigest,
SourceIdentity,
};
use lazaret_core::records::{ArtifactState, Domain, DurableDecision, Generation, PreparedArtifact};
use lazaret_host_coordinator::cold_start::{ColdStart, ColdStartInputs};
@ -280,6 +281,10 @@ impl ColdStartFixture {
invoking_uid: getuid().as_raw(),
escalation_client,
sandbox_init: escalation_client,
runsc: escalation_client,
runsc_program: Path::new("/bin/true"),
runsc_build_id: RunscBuildId::new([11; 32]),
runsc_digest: RunscDigest::new([12; 32]),
user_namespace_map: test_user_namespace_map(),
}
}

4
crates/lazaret-host-coordinator/tests/runtime-composition.rs
View file

@ -16,7 +16,7 @@ use lazaret_core::configuration::{
};
use lazaret_core::identity::{
BundleDigest, ClientId, ContainerId, CoordinatorId, GenerationId, HostPath, NetworkSidecarId,
PidfsProcessIdentityV1, SandboxId, SessionAnchorId, SessionId,
PidfsProcessIdentityV1, RunscBuildId, RunscDigest, SandboxId, SessionAnchorId, SessionId,
};
use lazaret_core::network::derive_ipv4_policy;
use lazaret_core::records::{
@ -28,7 +28,7 @@ use lazaret_host_coordinator::domain_store::{DomainStoreMutation, HostCoordinato
use lazaret_host_coordinator::git_routing::GitRoutingCoordinator;
use lazaret_host_coordinator::network::NetworkCoordinator;
use lazaret_host_coordinator::runtime::{
AwaitingAttachedRunsc, CommittedSandboxRuntime, SandboxCoordinator,
AwaitingAttachedRunsc, CommittedSandboxRuntime, SandboxCoordinator, SandboxIntent,
};
use lazaret_host_coordinator::terminal::{
NoActivePrompt, RunscSessionTerminalFactory, SessionTerminalEngine, TerminalAcquisition,

44
crates/lazaret-host-coordinator/tests/runtime-composition/fixtures.rs
View file

@ -4,11 +4,11 @@ use super::{
DurableDecision, File, Generation, GenerationId, GitRoutingCoordinator,
HostCoordinatorDomainStore, HostPath, HostProcessOwnershipSlot, Ipv4Addr, MatrixError,
NETWORK_NAMESPACE_PATH, NetworkCoordinator, NetworkSidecarId, Path, PathBuf,
ProcessOwnershipContext, ResolvedDomainConfiguration, RootProcess, RunscCommand,
RuntimeGitRoutingAuthority, RuntimeGitRoutingLaunch, RuntimeNetworkLaunch,
ProcessOwnershipContext, ResolvedDomainConfiguration, RootProcess, RunscBuildId, RunscCommand,
RunscDigest, RuntimeGitRoutingAuthority, RuntimeGitRoutingLaunch, RuntimeNetworkLaunch,
RuntimeSupervisorLaunch, SandboxBuildRequest, SandboxBundle, SandboxCoordinator, SandboxId,
SocketAddr, SocketAddrExt, TargetCommand, TcpListener, TempDir, UnixListener, UserNamespaceMap,
build_sandbox_bundle, build_sandbox_bundle_with_workspace, child_broker,
SandboxIntent, SocketAddr, SocketAddrExt, TargetCommand, TcpListener, TempDir, UnixListener,
UserNamespaceMap, build_sandbox_bundle, build_sandbox_bundle_with_workspace, child_broker,
current_mount_identity, current_process_identity, default_sandbox_layout, derive_ipv4_policy,
failure, fs, hex, host_path, load_trusted_configuration, lock_file,
stage_benchmark_rootfs_and_control, stage_rootfs_and_control, try_exclusive_flock,
@ -132,6 +132,7 @@ impl Fixture {
lazaret_linux::filesystem::namespace_identity(Path::new(NETWORK_NAMESPACE_PATH))?;
let bundle = build_sandbox_bundle(SandboxBuildRequest {
configuration: &configuration,
runsc_program: Path::new("/usr/local/bin/runsc"),
container_id: ContainerId::new([6; 32]),
expected_network_namespace: namespace,
root_process,
@ -199,6 +200,7 @@ impl Fixture {
lazaret_linux::filesystem::namespace_identity(Path::new(NETWORK_NAMESPACE_PATH))?;
let request = SandboxBuildRequest {
configuration: &configuration,
runsc_program: Path::new("/usr/local/bin/runsc"),
container_id,
expected_network_namespace: namespace,
root_process,
@ -261,14 +263,16 @@ impl Fixture {
})])
.map_err(failure)?;
SandboxCoordinator::new(&store)
.begin_intent(
GenerationId::new(7),
.begin_intent(SandboxIntent {
generation_id: GenerationId::new(7),
container_id,
&runtime_domain.join("runsc"),
current_mount_identity(&runtime_domain.join("runsc"))?,
BundleDigest::new([7; 32]),
current_process_identity()?,
)
runtime_root: &runtime_domain.join("runsc"),
runtime_root_identity: current_mount_identity(&runtime_domain.join("runsc"))?,
bundle_digest: BundleDigest::new([7; 32]),
runsc_build_id: RunscBuildId::new([8; 32]),
runsc_digest: RunscDigest::new([8; 32]),
host_coordinator: current_process_identity()?,
})
.map_err(failure)?;
Ok(Self {
_tree: tree,
@ -338,6 +342,7 @@ impl Fixture {
lazaret_linux::filesystem::namespace_identity(Path::new(NETWORK_NAMESPACE_PATH))?;
build_sandbox_bundle(SandboxBuildRequest {
configuration: &self.configuration,
runsc_program: Path::new("/usr/local/bin/runsc"),
container_id: ContainerId::new([6; 32]),
expected_network_namespace: namespace,
root_process: RootProcess::new(
@ -478,6 +483,7 @@ impl NetworkFixture {
lazaret_linux::filesystem::namespace_identity(Path::new(NETWORK_NAMESPACE_PATH))?;
let bundle = build_sandbox_bundle(SandboxBuildRequest {
configuration: &configuration,
runsc_program: Path::new("/usr/local/bin/runsc"),
container_id,
expected_network_namespace: namespace,
root_process,
@ -609,14 +615,16 @@ fn network_store(
})])
.map_err(failure)?;
SandboxCoordinator::new(&store)
.begin_intent(
GenerationId::new(7),
.begin_intent(SandboxIntent {
generation_id: GenerationId::new(7),
container_id,
&runtime_domain.join("runsc"),
current_mount_identity(&runtime_domain.join("runsc"))?,
BundleDigest::new([17; 32]),
current_process_identity()?,
)
runtime_root: &runtime_domain.join("runsc"),
runtime_root_identity: current_mount_identity(&runtime_domain.join("runsc"))?,
bundle_digest: BundleDigest::new([17; 32]),
runsc_build_id: RunscBuildId::new([18; 32]),
runsc_digest: RunscDigest::new([18; 32]),
host_coordinator: current_process_identity()?,
})
.map_err(failure)?;
Ok(store)
}