ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Replace external reachability with an owned canary

Browse source
This commit is contained in:
ms2k 2026-07-19 22:39:31 +09:00
commit 31e9ab0f2d
1 changed files with 1409 additions and 1972 deletions
Download patch file Download diff file Expand all files Collapse all files

15
crates/lazaret-runtime-supervisor/tests/sandbox_builder.rs
View file

@ -57,11 +57,6 @@ volumes = [
{{ host = "{{profile_dir}}/read-write", container = "/root/read-write", kind = "directory", access = "read-write", create = true }},
]
[profiles.default.readiness]
denied = [{{ address = "10.20.30.40", port = 443 }}]
permitted = [{{ address = "192.0.2.10", port = 443 }}]
dns = [{{ resolver = "198.51.100.53", query = "example.invalid" }}]
[profiles.unselected]
image = "example.invalid/unselected:v1"
env = {{ UNSELECTED_SECRET = "env:UNSELECTED_HOST_SECRET" }}
@ -103,7 +98,7 @@ env = {{ UNSELECTED_SECRET = "env:UNSELECTED_HOST_SECRET" }}
fn terminal(&self) -> lazaret_runtime_supervisor::sandbox::StagedHostTerminal {
let terminal = HostTerminal::from_compiled_entry(
"xterm-lazaret",
Some("truecolor".to_owned()),
Some("truecolor"),
fs::read(&self.terminfo_source).unwrap(),
)
.unwrap();
@ -174,6 +169,7 @@ env = {{ UNSELECTED_SECRET = "env:UNSELECTED_HOST_SECRET" }}
format!("sandbox-control/{container}/mailbox/requests"),
format!("sandbox-control/{container}/mailbox/results"),
format!("sandbox-control/{container}/bin"),
format!("sandbox-control/{container}/readiness"),
] {
fs::create_dir_all(runtime.join(directory)).unwrap();
}
@ -420,7 +416,7 @@ fn product_init_role_has_exact_terminal_neutral_rootless_bundle_shape() {
}
#[test]
fn selected_environment_volume_modes_and_host_terminal_are_preserved() {
fn trusted_init_environment_is_empty_and_volume_modes_are_preserved() {
let fixture = Fixture::new();
let bundle = build_sandbox_bundle(fixture.request(root_process([]))).unwrap();
let specification = value(&bundle);
@ -430,10 +426,7 @@ fn selected_environment_volume_modes_and_host_terminal_are_preserved() {
.iter()
.map(|entry| entry.as_str().unwrap())
.collect::<BTreeSet<_>>();
assert!(environment.contains("SELECTED_SECRET=selected-value"));
assert!(environment.contains("TERM=xterm-lazaret"));
assert!(environment.contains("COLORTERM=truecolor"));
assert!(environment.contains("TERMINFO_DIRS=/run/lazaret/terminfo:"));
assert!(environment.is_empty());
let mounts = mounts(&specification);
assert!(options(mounts[WORKSPACE_DESTINATION]).contains("rw"));