ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Establish bounded descriptor budgets for sandbox domains

Browse source
This commit is contained in:
ms2k 2026-07-24 02:18:30 +09:00
commit 503f090121
1 changed files with 191 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

10
crates/lazaret-runtime-supervisor/tests/sandbox_builder.rs
View file

@ -9,7 +9,7 @@ use lazaret_core::configuration::{
};
use lazaret_core::identity::{ContainerId, DeviceId, InodeId, NamespaceIdentity};
use lazaret_runtime_supervisor::sandbox::{
CONTROL_ROOT_DESTINATION, CREDENTIALS_DESTINATION, DEV_DESTINATION,
CONTROL_ROOT_DESTINATION, CREDENTIALS_DESTINATION, DEV_DESTINATION, DOMAIN_OPEN_FILE_LIMIT,
ESCALATION_CLIENT_DESTINATION, HOSTNAME_DESTINATION, HOSTS_DESTINATION, HostTerminal,
MAILBOX_REQUESTS_DESTINATION, MAILBOX_RESULTS_DESTINATION, NETWORK_NAMESPACE_PATH,
PROC_DESTINATION, RESOLV_CONF_DESTINATION, RootProcess, SANDBOX_INIT_DESTINATION,
@ -283,6 +283,14 @@ fn deterministic_snapshot_has_only_private_namespaces_and_fixed_runtime_shape()
assert_eq!(specification["process"]["terminal"], false);
assert_eq!(specification["process"]["noNewPrivileges"], true);
assert_eq!(specification["process"]["cwd"], WORKSPACE_DESTINATION);
assert_eq!(
specification["process"]["rlimits"],
serde_json::json!([{
"type": "RLIMIT_NOFILE",
"hard": DOMAIN_OPEN_FILE_LIMIT,
"soft": DOMAIN_OPEN_FILE_LIMIT
}])
);
assert_eq!(
specification["process"]["args"],
serde_json::json!([