ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Own the patched runsc artifact and bind recovery identity

Browse source
This commit is contained in:
ms2k 2026-07-26 18:01:03 +09:00
commit 2c420012bd
1 changed files with 1967 additions and 130 deletions
Download patch file Download diff file Expand all files Collapse all files

6
crates/lazaret-runtime-supervisor/tests/sandbox_builder.rs
View file

@ -143,6 +143,7 @@ env = {{ UNSELECTED_SECRET = "env:UNSELECTED_HOST_SECRET" }}
fn request(&self, root_process: RootProcess) -> SandboxBuildRequest<'_> {
SandboxBuildRequest {
configuration: &self.configuration,
runsc_program: Path::new("/usr/bin/runsc"),
container_id: ContainerId::new([0x11; 32]),
expected_network_namespace: current_network_namespace(),
root_process,
@ -352,7 +353,7 @@ fn routed_workspace_source_replaces_only_the_workspace_bind_source() {
}
fn assert_runtime_command(bundle: &SandboxBundle, fixture: &Fixture) {
assert_eq!(bundle.command().program(), OsStr::new("runsc"));
assert_eq!(bundle.command().program(), OsStr::new("/usr/bin/runsc"));
let runtime_domain = String::from_utf8(
fixture
.configuration
@ -421,6 +422,7 @@ fn configured_dcache_is_fingerprinted_and_passed_to_runsc() {
);
let bundle = build_sandbox_bundle(SandboxBuildRequest {
configuration: &configuration,
runsc_program: Path::new("/usr/bin/runsc"),
container_id: ContainerId::new([0x11; 32]),
expected_network_namespace: current_network_namespace(),
root_process: root_process([]),
@ -650,6 +652,7 @@ fn hostile_terminal_names_sources_and_changed_entries_fail_closed() {
.unwrap();
let error = build_sandbox_bundle(SandboxBuildRequest {
configuration: &fixture.configuration,
runsc_program: Path::new("/usr/bin/runsc"),
container_id: ContainerId::new([0x11; 32]),
expected_network_namespace: current_network_namespace(),
root_process: root_process([]),
@ -684,6 +687,7 @@ fn invalid_processes_and_wrong_network_identity_fail_closed() {
}
let error = build_sandbox_bundle(SandboxBuildRequest {
configuration: &fixture.configuration,
runsc_program: Path::new("/usr/bin/runsc"),
container_id: ContainerId::new([0x11; 32]),
expected_network_namespace: NamespaceIdentity {
device: DeviceId::new(u64::MAX),