Require fresh State Anchor absence before lease release

This commit is contained in:
ms2k 2026-07-17 04:40:02 +09:00
commit 3b76b59bdf

View file

@ -11,7 +11,7 @@ use lazaret_core::identity::{ContainerId, DeviceId, InodeId, NamespaceIdentity};
use lazaret_runtime_supervisor::sandbox::{
CREDENTIALS_DESTINATION, ESCALATION_CLIENT_DESTINATION, HostTerminal,
MAILBOX_REQUESTS_DESTINATION, MAILBOX_RESULTS_DESTINATION, NETWORK_NAMESPACE_PATH, RootProcess,
SANDBOX_INIT_DESTINATION, SandboxBuildErrorKind, SandboxBuildRequest,
SANDBOX_INIT_DESTINATION, SandboxBuildErrorKind, SandboxBuildRequest, SandboxBundle,
TERMINFO_ROOT_DESTINATION, WORKSPACE_DESTINATION, build_sandbox_bundle,
production_sandbox_layout, stage_host_terminal,
};
@ -312,7 +312,20 @@ fn deterministic_snapshot_has_only_private_namespaces_and_fixed_runtime_shape()
}])
);
assert_eq!(first.command().program(), OsStr::new("runsc"));
assert_runtime_command(&first, &fixture);
assert_eq!(
specification["root"]["path"],
fixture
.tree
.path()
.join("prepared-root")
.display()
.to_string()
);
}
fn assert_runtime_command(bundle: &SandboxBundle, fixture: &Fixture) {
assert_eq!(bundle.command().program(), OsStr::new("runsc"));
let runtime_domain = String::from_utf8(
fixture
.configuration
@ -323,7 +336,7 @@ fn deterministic_snapshot_has_only_private_namespaces_and_fixed_runtime_shape()
)
.unwrap();
assert_eq!(
first
bundle
.command()
.arguments()
.iter()
@ -355,16 +368,7 @@ fn deterministic_snapshot_has_only_private_namespaces_and_fixed_runtime_shape()
"11".repeat(32),
]
);
assert_eq!(
specification["root"]["path"],
fixture
.tree
.path()
.join("prepared-root")
.display()
.to_string()
);
assert!(!first.command().arguments().iter().any(|argument| {
assert!(!bundle.command().arguments().iter().any(|argument| {
matches!(
argument.to_str(),
Some("-detach" | "-console-socket" | "-c")