ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Compose protected runtime files before sandbox handoff

Browse source
This commit is contained in:
ms2k 2026-07-22 00:40:37 +09:00
commit af9b4de85a
1 changed files with 103 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
crates/lazaret-host-coordinator/src/cold_start.rs
View file

@ -180,6 +180,10 @@ impl<'a> ColdStart<'a> {
.map_err(|error| failure(format!("Git-routing staging: {error}")))?;
let expected_network_namespace = namespace_identity(Path::new(NETWORK_NAMESPACE_PATH))
.map_err(|error| failure(format!("network namespace: {error}")))?;
let network_policy = derive_ipv4_policy(inputs.configuration)
.map_err(|error| failure(format!("network policy: {error}")))?;
runtime_files::replace_protected_runtime_files(&state_anchor_layout, &network_policy)
.map_err(|error| failure(format!("protected runtime files: {error}")))?;
let request = SandboxBuildRequest {
configuration: inputs.configuration,
container_id: inputs.container_id,
@ -198,8 +202,6 @@ impl<'a> ColdStart<'a> {
staging
.write_bundle(sandbox_bundle.specification_json())
.map_err(|error| failure(format!("bundle staging: {error}")))?;
let network_policy = derive_ipv4_policy(inputs.configuration)
.map_err(|error| failure(format!("network policy: {error}")))?;
let ownership = ProcessOwnershipContext {
domain_id: inputs.generation.domain_id,
generation_id: inputs.generation.generation_id,
@ -414,6 +416,7 @@ fn require_inputs(inputs: &ColdStartInputs<'_>) -> Result<(), ColdStartError> {
}
mod git_routing;
mod runtime_files;
mod runtime_staging;
use git_routing::GitRoutingLayout;