ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Replace external reachability with an owned canary

Browse source
This commit is contained in:
ms2k 2026-07-19 22:39:31 +09:00
commit 31e9ab0f2d
1 changed files with 1409 additions and 1972 deletions
Download patch file Download diff file Expand all files Collapse all files

52
crates/lazaret-host-coordinator/src/bootstrap.rs
View file

@ -5,14 +5,13 @@ use std::sync::Mutex;
use lazaret_core::configuration::ResolvedDomainConfiguration;
use lazaret_core::identity::{BundleDigest, ContainerId, HostPath, MountIdentity};
use lazaret_core::network::{CanonicalDerivedNetworkPolicy, ReachabilityExpectation};
use lazaret_core::network::CanonicalDerivedNetworkPolicy;
use lazaret_core::records::Session;
use lazaret_core::records::{
Generation, GenerationIdentity, Participant, ParticipantOwnership, ParticipantRole,
ParticipantState, PreparedArtifact,
};
use lazaret_linux::process::{ProcessOwnershipContext, current_process_identity};
use lazaret_runtime_supervisor::network::NetworkProbeRequest;
use lazaret_runtime_supervisor::sandbox::SandboxBundle;
use lazaret_runtime_supervisor::supervision::RuntimeSupervisorLaunch;
use lazaret_state_anchor::StateAnchorLayout;
@ -70,8 +69,6 @@ pub struct BootstrapPlan<'a> {
pub runtime_launch: RuntimeSupervisorLaunch,
pub sandbox_bundle: &'a SandboxBundle,
pub network_policy: &'a CanonicalDerivedNetworkPolicy,
pub network_probe: NetworkProbeRequest,
pub reachability: &'a ReachabilityExpectation,
pub container_id: ContainerId,
pub runtime_root: PathBuf,
pub bundle_digest: BundleDigest,
@ -98,6 +95,7 @@ pub struct CoordinatorLifecycleAdapter<'a> {
escalation: Option<EscalationService<'a>>,
escalation_handle: Option<EscalationServiceHandle>,
awaiting_runtime: Option<AwaitingAttachedRunsc>,
awaiting_sandbox: Option<crate::runtime::AwaitingSandboxReadiness>,
runtime: Option<CommittedSandboxRuntime>,
state_anchor_mount: Option<MountIdentity>,
git_routing_mount: Option<MountIdentity>,
@ -197,6 +195,7 @@ impl<'a> CoordinatorLifecycleAdapter<'a> {
escalation: None,
escalation_handle: None,
awaiting_runtime: None,
awaiting_sandbox: None,
runtime: None,
state_anchor_mount: None,
git_routing_mount: None,
@ -330,12 +329,16 @@ impl<'a> CoordinatorLifecycleAdapter<'a> {
fn start_connectivity_helper(&mut self) -> Result<(), LifecycleServiceError> {
let store = Arc::clone(&self.plan.store);
let network = NetworkCoordinator::new(&store);
self.awaiting_runtime
let awaiting = self
.awaiting_runtime
.as_mut()
.ok_or_else(|| LifecycleServiceError("Runtime Supervisor is absent".into()))?
.ok_or_else(|| LifecycleServiceError("Runtime Supervisor is absent".into()))?;
awaiting
.receive_helper_staged(&network)
.map(|_| ())
.map_err(|error| failure(format!("starting connectivity helper: {error}")))
.map_err(|error| failure(format!("starting connectivity helper: {error}")))?;
awaiting
.receive_network_attestation(&network, self.plan.network_policy)
.map_err(|error| failure(format!("attesting prepared network: {error}")))
}
fn start_sidecar(&mut self) -> Result<(), LifecycleServiceError> {
@ -349,21 +352,16 @@ impl<'a> CoordinatorLifecycleAdapter<'a> {
fn mark_network_ready(&mut self) -> Result<(), LifecycleServiceError> {
let store = Arc::clone(&self.plan.store);
let network = NetworkCoordinator::new(&store);
let mut probe = self.plan.network_probe.clone();
self.awaiting_runtime
.as_mut()
.ok_or_else(|| LifecycleServiceError("Runtime Supervisor is absent".into()))?
.receive_network_readiness(
&network,
self.plan.network_policy,
|namespace| {
probe.enforcement_namespace = namespace;
probe
},
self.plan.reachability,
)
.map(|_| ())
.map_err(|error| failure(format!("marking network ready: {error}")))
let sandbox = SandboxCoordinator::new(&store);
let pending = self
.awaiting_sandbox
.take()
.ok_or_else(|| LifecycleServiceError("Sandbox readiness is absent".into()))?;
let (runtime, _) = pending
.commit_networked(&sandbox, &network, self.plan.network_policy)
.map_err(|error| failure(format!("marking network ready: {error}")))?;
self.runtime = Some(runtime);
Ok(())
}
fn start_sandbox(&mut self) -> Result<(), LifecycleServiceError> {
@ -381,12 +379,10 @@ impl<'a> CoordinatorLifecycleAdapter<'a> {
.sandbox_bundle
.capture_handoff_authority(self.plan.configuration)
.map_err(|error| failure(format!("capturing sandbox handoff: {error}")))?;
let (runtime, _) = pending
let awaiting = pending
.acknowledge(staged, &handoff)
.map_err(|error| failure(format!("releasing sandbox handoff: {error}")))?
.commit_networked(&sandbox)
.map_err(|error| failure(format!("committing sandbox readiness: {error}")))?;
self.runtime = Some(runtime);
.map_err(|error| failure(format!("releasing sandbox handoff: {error}")))?;
self.awaiting_sandbox = Some(awaiting);
Ok(())
}