ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Establish bounded descriptor budgets for sandbox domains

Browse source
This commit is contained in:
ms2k 2026-07-24 02:18:30 +09:00
commit 503f090121
1 changed files with 191 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

5
crates/lazaret-runtime-supervisor/src/sandbox.rs
View file

@ -19,8 +19,8 @@ pub use lazaret_sandbox_contract::{
};
use oci_spec::runtime::{
Capabilities, Capability, LinuxBuilder, LinuxCapabilitiesBuilder, LinuxNamespaceBuilder,
LinuxNamespaceType, Mount, MountBuilder, ProcessBuilder, RootBuilder, Spec, SpecBuilder,
UserBuilder,
LinuxNamespaceType, Mount, MountBuilder, PosixRlimitBuilder, PosixRlimitType, ProcessBuilder,
RootBuilder, Spec, SpecBuilder, UserBuilder,
};
use rustix::fs::{AtFlags, FileType, Mode, OFlags, ResolveFlags, StatxFlags, openat2, statx};
use sha2::{Digest, Sha256};
@ -40,6 +40,7 @@ use validation::{
};
pub const NETWORK_NAMESPACE_PATH: &str = "/proc/self/ns/net";
pub const DOMAIN_OPEN_FILE_LIMIT: u64 = 524_288;
const OCI_VERSION: &str = "1.2.1";
const MAX_TERMINFO_BYTES: usize = 1_048_576;