ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Own the patched runsc artifact and bind recovery identity

Browse source
This commit is contained in:
ms2k 2026-07-26 18:01:03 +09:00
commit 2c420012bd
1 changed files with 1967 additions and 130 deletions
Download patch file Download diff file Expand all files Collapse all files

44
crates/lazaret-host-coordinator/tests/runtime-composition/fixtures.rs
View file

@ -4,11 +4,11 @@ use super::{
DurableDecision, File, Generation, GenerationId, GitRoutingCoordinator,
HostCoordinatorDomainStore, HostPath, HostProcessOwnershipSlot, Ipv4Addr, MatrixError,
NETWORK_NAMESPACE_PATH, NetworkCoordinator, NetworkSidecarId, Path, PathBuf,
ProcessOwnershipContext, ResolvedDomainConfiguration, RootProcess, RunscCommand,
RuntimeGitRoutingAuthority, RuntimeGitRoutingLaunch, RuntimeNetworkLaunch,
ProcessOwnershipContext, ResolvedDomainConfiguration, RootProcess, RunscBuildId, RunscCommand,
RunscDigest, RuntimeGitRoutingAuthority, RuntimeGitRoutingLaunch, RuntimeNetworkLaunch,
RuntimeSupervisorLaunch, SandboxBuildRequest, SandboxBundle, SandboxCoordinator, SandboxId,
SocketAddr, SocketAddrExt, TargetCommand, TcpListener, TempDir, UnixListener, UserNamespaceMap,
build_sandbox_bundle, build_sandbox_bundle_with_workspace, child_broker,
SandboxIntent, SocketAddr, SocketAddrExt, TargetCommand, TcpListener, TempDir, UnixListener,
UserNamespaceMap, build_sandbox_bundle, build_sandbox_bundle_with_workspace, child_broker,
current_mount_identity, current_process_identity, default_sandbox_layout, derive_ipv4_policy,
failure, fs, hex, host_path, load_trusted_configuration, lock_file,
stage_benchmark_rootfs_and_control, stage_rootfs_and_control, try_exclusive_flock,
@ -132,6 +132,7 @@ impl Fixture {
lazaret_linux::filesystem::namespace_identity(Path::new(NETWORK_NAMESPACE_PATH))?;
let bundle = build_sandbox_bundle(SandboxBuildRequest {
configuration: &configuration,
runsc_program: Path::new("/usr/local/bin/runsc"),
container_id: ContainerId::new([6; 32]),
expected_network_namespace: namespace,
root_process,
@ -199,6 +200,7 @@ impl Fixture {
lazaret_linux::filesystem::namespace_identity(Path::new(NETWORK_NAMESPACE_PATH))?;
let request = SandboxBuildRequest {
configuration: &configuration,
runsc_program: Path::new("/usr/local/bin/runsc"),
container_id,
expected_network_namespace: namespace,
root_process,
@ -261,14 +263,16 @@ impl Fixture {
})])
.map_err(failure)?;
SandboxCoordinator::new(&store)
.begin_intent(
GenerationId::new(7),
.begin_intent(SandboxIntent {
generation_id: GenerationId::new(7),
container_id,
&runtime_domain.join("runsc"),
current_mount_identity(&runtime_domain.join("runsc"))?,
BundleDigest::new([7; 32]),
current_process_identity()?,
)
runtime_root: &runtime_domain.join("runsc"),
runtime_root_identity: current_mount_identity(&runtime_domain.join("runsc"))?,
bundle_digest: BundleDigest::new([7; 32]),
runsc_build_id: RunscBuildId::new([8; 32]),
runsc_digest: RunscDigest::new([8; 32]),
host_coordinator: current_process_identity()?,
})
.map_err(failure)?;
Ok(Self {
_tree: tree,
@ -338,6 +342,7 @@ impl Fixture {
lazaret_linux::filesystem::namespace_identity(Path::new(NETWORK_NAMESPACE_PATH))?;
build_sandbox_bundle(SandboxBuildRequest {
configuration: &self.configuration,
runsc_program: Path::new("/usr/local/bin/runsc"),
container_id: ContainerId::new([6; 32]),
expected_network_namespace: namespace,
root_process: RootProcess::new(
@ -478,6 +483,7 @@ impl NetworkFixture {
lazaret_linux::filesystem::namespace_identity(Path::new(NETWORK_NAMESPACE_PATH))?;
let bundle = build_sandbox_bundle(SandboxBuildRequest {
configuration: &configuration,
runsc_program: Path::new("/usr/local/bin/runsc"),
container_id,
expected_network_namespace: namespace,
root_process,
@ -609,14 +615,16 @@ fn network_store(
})])
.map_err(failure)?;
SandboxCoordinator::new(&store)
.begin_intent(
GenerationId::new(7),
.begin_intent(SandboxIntent {
generation_id: GenerationId::new(7),
container_id,
&runtime_domain.join("runsc"),
current_mount_identity(&runtime_domain.join("runsc"))?,
BundleDigest::new([17; 32]),
current_process_identity()?,
)
runtime_root: &runtime_domain.join("runsc"),
runtime_root_identity: current_mount_identity(&runtime_domain.join("runsc"))?,
bundle_digest: BundleDigest::new([17; 32]),
runsc_build_id: RunscBuildId::new([18; 32]),
runsc_digest: RunscDigest::new([18; 32]),
host_coordinator: current_process_identity()?,
})
.map_err(failure)?;
Ok(store)
}