ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Compose protected runtime files before sandbox handoff

Browse source
This commit is contained in:
ms2k 2026-07-22 00:40:37 +09:00
commit af9b4de85a
2 changed files with 103 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
crates/lazaret-host-coordinator/src/cold_start.rs
View file

@ -180,6 +180,10 @@ impl<'a> ColdStart<'a> {
.map_err(|error| failure(format!("Git-routing staging: {error}")))?;
let expected_network_namespace = namespace_identity(Path::new(NETWORK_NAMESPACE_PATH))
.map_err(|error| failure(format!("network namespace: {error}")))?;
let network_policy = derive_ipv4_policy(inputs.configuration)
.map_err(|error| failure(format!("network policy: {error}")))?;
runtime_files::replace_protected_runtime_files(&state_anchor_layout, &network_policy)
.map_err(|error| failure(format!("protected runtime files: {error}")))?;
let request = SandboxBuildRequest {
configuration: inputs.configuration,
container_id: inputs.container_id,
@ -198,8 +202,6 @@ impl<'a> ColdStart<'a> {
staging
.write_bundle(sandbox_bundle.specification_json())
.map_err(|error| failure(format!("bundle staging: {error}")))?;
let network_policy = derive_ipv4_policy(inputs.configuration)
.map_err(|error| failure(format!("network policy: {error}")))?;
let ownership = ProcessOwnershipContext {
domain_id: inputs.generation.domain_id,
generation_id: inputs.generation.generation_id,
@ -414,6 +416,7 @@ fn require_inputs(inputs: &ColdStartInputs<'_>) -> Result<(), ColdStartError> {
}
mod git_routing;
mod runtime_files;
mod runtime_staging;
use git_routing::GitRoutingLayout;

25
crates/lazaret-host-coordinator/src/cold_start/runtime_files.rs Normal file
View file

@ -0,0 +1,25 @@
use std::net::{Ipv4Addr, Ipv6Addr};
use lazaret_core::network::CanonicalDerivedNetworkPolicy;
use lazaret_core::records::IpAddress;
use lazaret_state_anchor::{ProtectedRuntimeFiles, StateAnchorError, StateAnchorLayout};
pub(super) fn replace_protected_runtime_files(
layout: &StateAnchorLayout<'_>,
policy: &CanonicalDerivedNetworkPolicy,
) -> Result<(), StateAnchorError> {
let resolv_conf = policy
.policy()
.resolvers
.iter()
.map(|resolver| match resolver.address {
IpAddress::V4(address) => format!("nameserver {}\n", Ipv4Addr::from(address)),
IpAddress::V6(address) => format!("nameserver {}\n", Ipv6Addr::from(address)),
})
.collect::<String>();
layout.replace_protected_runtime_files(&ProtectedRuntimeFiles {
resolv_conf: resolv_conf.as_bytes(),
hosts: b"127.0.0.1 localhost\n",
hostname: b"lazaret\n",
})
}