ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Default profiles to persistent system paths

Browse source
This commit is contained in:
ms2k 2026-07-22 03:23:38 +09:00
commit acd0b4cc8c
2 changed files with 36 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

1
docs/example.toml
View file

@ -11,7 +11,6 @@ default_allow = ["192.0.2.53/32", "198.51.100.53/32"]
[profiles.default]
image = "docker.io/library/debian:trixie"
isolate_gitignored = true
persistent_dirs = ["/root"]
allow_egress = ["203.0.113.10/32"]
volumes = [
{ host = "{profile_dir}/agent-state", container = "/root/.local/state/agent", kind = "directory", access = "read-write", create = true },

4
docs/specification.md
View file

@ -295,6 +295,10 @@ later product mounts, and a layout cannot be constructed without `/workspace`.
Bundle construction, rather than trusted-host configuration syntax, owns the
exact destination choices and transient-child classification.
An omitted profile `persistent_dirs` field selects `/root`, `/usr`, `/var`,
`/etc`, and `/opt`. An explicit list replaces that default in full, including an
empty list or paths used by an unorthodox distribution.
The loader resolves environment references only after structural, path, and
network validation. A missing, non-UTF-8, or NUL-containing host value refuses
the selected profile. Resolved values live only in one move-owned,