ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Replace external reachability with an owned canary

Browse source
This commit is contained in:
ms2k 2026-07-19 22:39:31 +09:00
commit 31e9ab0f2d
1 changed files with 1409 additions and 1972 deletions
Download patch file Download diff file Expand all files Collapse all files

21
crates/lazaret-host-coordinator/src/cold_start.rs
View file

@ -11,9 +11,9 @@ use std::sync::{Arc, Mutex};
use lazaret_core::configuration::{ConfinedPathPlan, ResolvedDomainConfiguration};
use lazaret_core::identity::{BundleDigest, ContainerId, HostPath, MountIdentity};
use lazaret_core::network::{ReachabilityExpectation, derive_ipv4_policy};
use lazaret_core::network::derive_ipv4_policy;
use lazaret_core::records::{
Generation, GenerationIdentity, HostProcessOwnershipSlot, IpAddress, PreparedArtifact, Session,
Generation, GenerationIdentity, HostProcessOwnershipSlot, PreparedArtifact, Session,
};
use lazaret_ignored_workspace::git_common_directory;
use lazaret_linux::filesystem::{RegularFileMailbox, mount_identity, namespace_identity};
@ -21,7 +21,6 @@ use lazaret_linux::process::{
ProcessOwnershipContext, TargetCommand, child_broker, current_process_identity,
};
use lazaret_linux::user_namespace::UserNamespaceMap;
use lazaret_runtime_supervisor::network::NetworkProbeRequest;
use lazaret_runtime_supervisor::sandbox::{
RootProcess, SandboxBuildRequest, SandboxBundle, build_sandbox_bundle,
build_sandbox_bundle_with_workspace,
@ -79,9 +78,6 @@ pub struct ColdStartInputs<'a> {
pub prepared_artifact_authority: &'a File,
pub prepared_artifact_label: &'a Path,
pub root_process: RootProcess,
pub resolver_addresses: Vec<IpAddress>,
pub network_probe: NetworkProbeRequest,
pub reachability: ReachabilityExpectation,
pub container_id: ContainerId,
pub invoking_uid: u32,
pub escalation_client: &'a File,
@ -142,8 +138,6 @@ pub struct ColdStart<'a> {
runtime_launch: Option<RuntimeSupervisorLaunch>,
sandbox_bundle: SandboxBundle,
network_policy: lazaret_core::network::CanonicalDerivedNetworkPolicy,
network_probe: NetworkProbeRequest,
reachability: ReachabilityExpectation,
container_id: ContainerId,
runtime_root: PathBuf,
bundle_digest: BundleDigest,
@ -204,7 +198,7 @@ impl<'a> ColdStart<'a> {
staging
.write_bundle(sandbox_bundle.specification_json())
.map_err(|error| failure(format!("bundle staging: {error}")))?;
let network_policy = derive_ipv4_policy(inputs.configuration, inputs.resolver_addresses)
let network_policy = derive_ipv4_policy(inputs.configuration)
.map_err(|error| failure(format!("network policy: {error}")))?;
let ownership = ProcessOwnershipContext {
domain_id: inputs.generation.domain_id,
@ -263,8 +257,6 @@ impl<'a> ColdStart<'a> {
runtime_launch: Some(runtime_launch),
sandbox_bundle,
network_policy,
network_probe: inputs.network_probe,
reachability: inputs.reachability,
container_id: inputs.container_id,
runtime_root: runtime_domain.join("runsc"),
bundle_digest,
@ -366,6 +358,7 @@ impl<'a> ColdStart<'a> {
self.container_id,
current_process_identity().map_err(failure)?,
self.sandbox_bundle.command(),
self.configuration.ephemeral_environment().clone(),
self.runtime_root.clone(),
)
.map_err(failure)?;
@ -383,8 +376,6 @@ impl<'a> ColdStart<'a> {
.ok_or_else(|| ColdStartError("cold start was already consumed".into()))?,
sandbox_bundle: &self.sandbox_bundle,
network_policy: &self.network_policy,
network_probe: self.network_probe.clone(),
reachability: &self.reachability,
container_id: self.container_id,
runtime_root: self.runtime_root.clone(),
bundle_digest: self.bundle_digest,
@ -393,6 +384,7 @@ impl<'a> ColdStart<'a> {
RunscNonInteractiveExecutor::from_run_command(
self.sandbox_bundle.command(),
self.container_id,
self.configuration.ephemeral_environment().clone(),
)
.map_err(failure)?,
),
@ -414,9 +406,6 @@ fn require_inputs(inputs: &ColdStartInputs<'_>) -> Result<(), ColdStartError> {
if inputs.generation.domain_id != inputs.configuration.domain_id()
|| inputs.generation.configuration_fingerprint
!= inputs.configuration.configuration_fingerprint()
|| inputs.network_probe.domain_id != inputs.generation.domain_id
|| inputs.network_probe.generation_id != inputs.generation.generation_id
|| inputs.resolver_addresses.is_empty()
|| inputs.invoking_uid != rustix::process::getuid().as_raw()
{
return Err(ColdStartError("cold-start inputs disagree".into()));