Establish bounded descriptor budgets for sandbox domains

crates/lazaret-host-coordinator/tests/nofile.rs

@@ -0,0 +1,39 @@
+use std::process::ExitCode;
+
+use lazaret_host_coordinator::client_bootstrap::ensure_domain_nofile_limit;
+use lazaret_runtime_supervisor::sandbox::DOMAIN_OPEN_FILE_LIMIT;
+use rustix::process::{Resource, Rlimit, getrlimit, setrlimit};
+
+fn main() -> ExitCode {
+    match verify_low_inherited_soft_limit() {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(error) => {
+            eprintln!("NOFILE fixture failed: {error}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+fn verify_low_inherited_soft_limit() -> Result<(), Box<dyn std::error::Error>> {
+    let inherited = getrlimit(Resource::Nofile);
+    if let Some(maximum) = inherited.maximum
+        && maximum < DOMAIN_OPEN_FILE_LIMIT
+    {
+        return Err(
+            format!("test host hard limit {maximum} is below {DOMAIN_OPEN_FILE_LIMIT}").into(),
+        );
+    }
+    setrlimit(
+        Resource::Nofile,
+        Rlimit {
+            current: Some(1_024),
+            maximum: inherited.maximum,
+        },
+    )?;
+    ensure_domain_nofile_limit()?;
+    let observed = getrlimit(Resource::Nofile);
+    if observed.current != Some(DOMAIN_OPEN_FILE_LIMIT) || observed.maximum != inherited.maximum {
+        return Err(format!("unexpected raised limit: {observed:?}").into());
+    }
+    Ok(())
+}