ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Compose cold-start resources under Runtime Supervisor ownership

Browse source
This commit is contained in:
ms2k 2026-07-16 17:29:23 +09:00
commit 33ac0ba4ee
1 changed files with 1827 additions and 139 deletions
Download patch file Download diff file Expand all files Collapse all files

44
crates/lazaret-state-anchor/tests/state-anchor-lifecycle.rs
View file

@ -19,8 +19,9 @@ use lazaret_linux::process::{
ProcessOwnershipContext, current_process_identity, dispatch_private_process_role,
};
use lazaret_state_anchor::{
FuseOverlayfsMount, ProtectedRuntimeFiles, StateAnchorAcquisition, StateAnchorLayout,
StateAnchorSandboxView, unmount_after_coordinator_loss,
FuseOverlayfsMount, ProtectedRuntimeFiles, RuntimeStateAnchorAuthority, StateAnchorAcquisition,
StateAnchorLaunchAuthority, StateAnchorLayout, StateAnchorSandboxView,
unmount_after_coordinator_loss,
};
use rustix::process::Signal;
@ -77,6 +78,45 @@ fn run() -> io::Result<()> {
};
let layout = StateAnchorLayout::create(&configuration).map_err(io::Error::other)?;
let launch =
StateAnchorLaunchAuthority::capture(&layout, &artifact).map_err(io::Error::other)?;
let runtime_authority = RuntimeStateAnchorAuthority::from_inherited(
launch.lower_fd(),
launch.persistent_anchor_fd(),
launch.runtime_anchor_fd(),
launch.expected_lower(),
)
.map_err(io::Error::other)?;
let expected = std::cell::Cell::new(None);
let runtime_mount = runtime_authority
.acquire(
current_process_identity()?,
ProcessOwnershipContext {
domain_id: DomainId::new([1; 32]),
generation_id: GenerationId::new(1),
coordinator_id: CoordinatorId::new([3; 32]),
slot: HostProcessOwnershipSlot::StateAnchorDaemon,
},
|staged| {
expected.set(Some(staged));
Ok(())
},
|staged| Ok(ProcessOwnershipCommitAck::v1(staged)),
|readiness| {
if expected.get() != Some(readiness.staged())
|| lazaret_linux::filesystem::current_mount_identity(layout.merged())?
!= readiness.mount()
{
return Err(io::Error::other(
"inherited State Anchor readiness changed authority",
));
}
Ok(())
},
)
.map_err(io::Error::other)?;
runtime_mount.unmount().map_err(io::Error::other)?;
let first = acquire(&layout, &artifact)?;
fs::write(
layout.merged().join("usr/bin/installed-tool"),