ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Compose selected State Anchor paths over prepared roots

Browse source
This commit is contained in:
ms2k 2026-07-17 03:58:27 +09:00
commit 4dd2b150d2
2 changed files with 1575 additions and 163 deletions
Download patch file Download diff file Expand all files Collapse all files

16
crates/lazaret-host-coordinator/tests/production.rs
View file

@ -27,10 +27,13 @@ fn validated_inputs_stage_one_complete_plan_and_drop_exact_runtime_artifacts() {
let staged = ProductionColdStart::stage(fixture.inputs(&fixture.escalation_client)).unwrap();
let bundle = fixture.bundle();
let control = fixture.control();
let overlay = fixture.overlay();
assert_private_artifacts(&bundle, &control);
assert!(overlay.is_dir());
drop(staged);
assert!(!bundle.exists());
assert!(!control.exists());
assert!(!overlay.exists());
assert!(
ProductionColdStart::stage(fixture.inputs(&fixture.invalid_escalation_client)).is_err()
);
@ -90,6 +93,7 @@ struct ProductionFixture {
catalog: Catalog,
store: Arc<HostCoordinatorDomainStore>,
artifact: PreparedArtifact,
artifact_authority: File,
generation: Generation,
container_id: ContainerId,
escalation_client: File,
@ -139,6 +143,7 @@ impl ProductionFixture {
let lower = tree.path().join("prepared-lower");
fs::create_dir(&lower).unwrap();
let metadata = lower.metadata().unwrap();
let artifact_authority = File::open(&lower).unwrap();
let artifact = PreparedArtifact {
prepared_artifact_id: PreparedArtifactId::new([8; 32]),
source_identity: SourceIdentity::new(b"synthetic-spike".to_vec()),
@ -166,6 +171,7 @@ impl ProductionFixture {
catalog,
store,
artifact,
artifact_authority,
generation,
container_id: ContainerId::new([5; 32]),
escalation_client: File::open("/bin/true").unwrap(),
@ -180,6 +186,10 @@ impl ProductionFixture {
configuration: &self.configuration,
generation: self.generation.clone(),
prepared_artifact: &self.artifact,
prepared_artifact_authority: &self.artifact_authority,
prepared_artifact_label: Path::new(
std::str::from_utf8(self.artifact.path.as_bytes()).unwrap(),
),
root_process: RootProcess::new("/bin/sh", ["-c".into(), "sleep infinity".into()])
.unwrap(),
resolver_addresses: vec![IpAddress::V4([10, 0, 2, 3])],
@ -214,6 +224,12 @@ impl ProductionFixture {
.join("sandbox-control")
.join(hex(self.container_id.as_bytes()))
}
fn overlay(&self) -> PathBuf {
self.runtime_domain
.join("runsc-overlay")
.join(hex(self.container_id.as_bytes()))
}
}
fn assert_private_artifacts(bundle: &Path, control: &Path) {

78
crates/lazaret-host-coordinator/tests/runtime-composition.rs
View file

@ -686,6 +686,7 @@ impl Fixture {
expected_network_namespace: namespace,
root_process,
terminal: None,
prepared_root: runtime_domain.join("prepared-root"),
})
.map_err(failure)?;
Self::finish_build(
@ -743,6 +744,7 @@ impl Fixture {
expected_network_namespace: namespace,
root_process,
terminal: None,
prepared_root: runtime_domain.join("prepared-root"),
})
.map_err(failure)?;
Self::finish_build(
@ -846,6 +848,8 @@ impl Fixture {
)
.map_err(failure)?,
terminal: None,
prepared_root: host_path(self.configuration.runtime_domain_root().canonical_label())
.join("prepared-root"),
})
.map_err(failure)
}
@ -888,7 +892,7 @@ impl NetworkFixture {
let runtime_domain = host_path(configuration.runtime_domain_root().canonical_label());
let container_id = ContainerId::new([16; 32]);
stage_rootfs_and_control(&runtime_domain, container_id)?;
let rootfs = runtime_domain.join("state-anchor/merged");
let rootfs = runtime_domain.join("prepared-root");
fs::copy(
std::env::current_exe()?,
rootfs.join("bin/lazaret-network-probe"),
@ -917,6 +921,7 @@ impl NetworkFixture {
expected_network_namespace: namespace,
root_process,
terminal: None,
prepared_root: runtime_domain.join("prepared-root"),
})
.map_err(failure)?;
let bundle_path = runtime_domain
@ -1177,10 +1182,44 @@ fn stage_rootfs_and_control(
runtime_domain: &Path,
container_id: ContainerId,
) -> Result<(), MatrixError> {
let rootfs = runtime_domain.join("state-anchor/merged");
for directory in ["bin", "lib64"] {
let rootfs = runtime_domain.join("prepared-root");
for directory in [
"bin",
"lib64",
"dev",
"proc",
"sys",
"tmp",
"etc",
"home",
"workspace",
"run/lazaret/credentials",
"run/lazaret/mailbox/requests",
"run/lazaret/mailbox/results",
"run/lazaret/bin",
] {
fs::create_dir_all(rootfs.join(directory))?;
}
for file in [
"etc/resolv.conf",
"etc/hosts",
"etc/hostname",
"run/lazaret/bin/lazaret-escalate",
"run/lazaret/bin/lazaret-sandbox-init",
] {
fs::write(rootfs.join(file), b"")?;
}
fs::create_dir_all(runtime_domain.join("state-anchor/merged"))?;
let runtime_files = runtime_domain.join("state-anchor/runtime-files");
fs::create_dir_all(&runtime_files)?;
for file in ["resolv.conf", "hosts", "hostname"] {
fs::write(runtime_files.join(file), b"fixture")?;
}
fs::create_dir_all(
runtime_domain
.join("runsc-overlay")
.join(hex(container_id.as_bytes())),
)?;
for (source, destination) in [
("/bin/sh", "bin/sh"),
("/bin/sleep", "bin/sleep"),
@ -1199,11 +1238,12 @@ fn stage_rootfs_and_control(
fs::create_dir_all(control.join(directory))?;
}
fs::copy("/bin/true", control.join("bin/lazaret-escalate"))?;
fs::copy("/bin/true", control.join("bin/lazaret-sandbox-init"))?;
Ok(())
}
fn stage_benchmark_rootfs_and_control(runtime_domain: &Path) -> Result<(), MatrixError> {
let rootfs = runtime_domain.join("state-anchor/merged");
let rootfs = runtime_domain.join("prepared-root");
for directory in [
"bin",
"tooling/usr",
@ -1213,6 +1253,17 @@ fn stage_benchmark_rootfs_and_control(runtime_domain: &Path) -> Result<(), Matri
"fixtures/host",
"fixtures/output",
"fixtures/repository",
"dev",
"proc",
"sys",
"tmp",
"etc",
"home",
"workspace",
"run/lazaret/credentials",
"run/lazaret/mailbox/requests",
"run/lazaret/mailbox/results",
"run/lazaret/bin",
] {
fs::create_dir_all(rootfs.join(directory))?;
}
@ -1224,12 +1275,31 @@ fn stage_benchmark_rootfs_and_control(runtime_domain: &Path) -> Result<(), Matri
symlink("usr/lib", rootfs.join("lib"))?;
symlink("usr/lib64", rootfs.join("lib64"))?;
symlink("usr/sbin", rootfs.join("sbin"))?;
for file in [
"etc/resolv.conf",
"etc/hosts",
"etc/hostname",
"run/lazaret/bin/lazaret-escalate",
"run/lazaret/bin/lazaret-sandbox-init",
] {
fs::write(rootfs.join(file), b"")?;
}
for directory in ["tooling", "fixtures"] {
fs::create_dir_all(runtime_domain.join("state-anchor/merged").join(directory))?;
}
let runtime_files = runtime_domain.join("state-anchor/runtime-files");
fs::create_dir_all(&runtime_files)?;
for file in ["resolv.conf", "hosts", "hostname"] {
fs::write(runtime_files.join(file), b"fixture")?;
}
fs::create_dir_all(runtime_domain.join("runsc-overlay").join(hex(&[6; 32])))?;
let control = runtime_domain.join("sandbox-control").join(hex(&[6; 32]));
for directory in ["credentials", "mailbox/requests", "mailbox/results", "bin"] {
fs::create_dir_all(control.join(directory))?;
}
fs::copy("/bin/true", control.join("bin/lazaret-escalate"))?;
fs::copy("/bin/true", control.join("bin/lazaret-sandbox-init"))?;
Ok(())
}