ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Fix rootless launches with subordinate ID maps

Browse source 
Resolve and verify canonical caller subordinate ranges, launch preparation and runtime workers through mapped causal acquisition, and keep runsc in the existing user namespace. Repair descriptor-relative OCI cleanup and absent-mount recovery so failed launches can progress to the corrected path.
This commit is contained in:
ms2k 2026-07-19 19:51:47 +09:00
commit 73e3e9fdee
1 changed files with 1424 additions and 172 deletions
Download patch file Download diff file Expand all files Collapse all files

4
crates/lazaret-host-coordinator/src/cold_start.rs
View file

@ -20,6 +20,7 @@ use lazaret_linux::filesystem::{RegularFileMailbox, mount_identity, namespace_id
use lazaret_linux::process::{
ProcessOwnershipContext, TargetCommand, child_broker, current_process_identity,
};
use lazaret_linux::user_namespace::UserNamespaceMap;
use lazaret_runtime_supervisor::network::NetworkProbeRequest;
use lazaret_runtime_supervisor::sandbox::{
RootProcess, SandboxBuildRequest, SandboxBundle, build_sandbox_bundle,
@ -85,6 +86,7 @@ pub struct ColdStartInputs<'a> {
pub invoking_uid: u32,
pub escalation_client: &'a File,
pub sandbox_init: &'a File,
pub user_namespace_map: UserNamespaceMap,
}
pub struct BootstrapOwnerGuard {
@ -227,6 +229,8 @@ impl<'a> ColdStart<'a> {
},
)
.map_err(|error| failure(format!("Runtime Supervisor launch: {error}")))?
.with_user_namespace_map(inputs.user_namespace_map)
.map_err(|error| failure(format!("Runtime Supervisor user namespace: {error}")))?
.with_state_anchor(state_anchor)
.map_err(|error| failure(format!("Runtime Supervisor handoff: {error}")))?;
if let Some(git_routing) = &git_routing {