Compose protected runtime files before sandbox handoff

crates/lazaret-host-coordinator/tests/cold_start.rs

@@ -18,6 +18,7 @@ use lazaret_linux::user_namespace::{
     REQUIRED_SUBORDINATE_IDS, UserNamespaceIdRange, UserNamespaceMap,
 };
 use lazaret_runtime_supervisor::sandbox::{RootProcess, default_sandbox_layout};
+use lazaret_state_anchor::StateAnchorLayout;
 use lazaret_storage_catalog::Catalog;
 use rustix::process::{getgid, getuid};
 
@@ -48,6 +49,70 @@ fn non_git_workspace_stages_without_a_routing_runtime() {
     drop(staged);
 }
 
+#[test]
+fn production_stage_composes_derived_resolver_outside_the_prepared_lower() {
+    let fixture = ColdStartFixture::new();
+    let image_resolver = fixture.prepared_lower.join("etc/resolv.conf");
+    let upper_resolver = fixture
+        .persistent_domain
+        .join("state-anchor/upper/etc/resolv.conf");
+    let empty_runtime_resolver = StateAnchorLayout::create(&fixture.configuration).unwrap();
+    assert_eq!(
+        fs::read(empty_runtime_resolver.runtime_files().join("resolv.conf")).unwrap(),
+        b""
+    );
+    drop(empty_runtime_resolver);
+
+    let staged = ColdStart::stage(fixture.inputs(&fixture.escalation_client)).unwrap();
+
+    assert_eq!(fs::read(&image_resolver).unwrap(), b"image resolver\n");
+    assert!(!upper_resolver.exists());
+    assert_eq!(
+        fs::read(
+            fixture
+                .runtime_domain
+                .join("state-anchor/runtime-files/resolv.conf")
+        )
+        .unwrap(),
+        b"nameserver 10.137.54.3\n"
+    );
+    assert_eq!(
+        fs::read(
+            fixture
+                .runtime_domain
+                .join("state-anchor/runtime-files/hosts")
+        )
+        .unwrap(),
+        b"127.0.0.1 localhost\n"
+    );
+    assert_eq!(
+        fs::read(
+            fixture
+                .runtime_domain
+                .join("state-anchor/runtime-files/hostname")
+        )
+        .unwrap(),
+        b"lazaret\n"
+    );
+    let specification: serde_json::Value =
+        serde_json::from_slice(&fs::read(fixture.bundle().join("config.json")).unwrap()).unwrap();
+    let resolver_mount = specification["mounts"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .find(|mount| mount["destination"] == "/etc/resolv.conf")
+        .unwrap();
+    assert_eq!(
+        resolver_mount["source"],
+        fixture
+            .runtime_domain
+            .join("state-anchor/runtime-files/resolv.conf")
+            .display()
+            .to_string()
+    );
+    drop(staged);
+}
+
 #[test]
 fn cleanup_leaves_a_replacement_directory_untouched() {
     let fixture = ColdStartFixture::new();
@@ -96,7 +161,9 @@ fn replaced_runtime_domain_authority_is_not_used_for_staging() {
 struct ColdStartFixture {
     tree: tempfile::TempDir,
     configuration: lazaret_core::configuration::ResolvedDomainConfiguration,
+    persistent_domain: PathBuf,
     runtime_domain: PathBuf,
+    prepared_lower: PathBuf,
     catalog: Catalog,
     store: Arc<HostCoordinatorDomainStore>,
     artifact: PreparedArtifact,
@@ -149,6 +216,10 @@ impl ColdStartFixture {
         );
         let lower = tree.path().join("prepared-lower");
         fs::create_dir(&lower).unwrap();
+        fs::create_dir(lower.join("etc")).unwrap();
+        fs::write(lower.join("etc/resolv.conf"), b"image resolver\n").unwrap();
+        fs::write(lower.join("etc/hosts"), b"image hosts\n").unwrap();
+        fs::write(lower.join("etc/hostname"), b"image hostname\n").unwrap();
         let metadata = lower.metadata().unwrap();
         let artifact_authority = File::open(&lower).unwrap();
         let artifact = PreparedArtifact {
@@ -174,7 +245,9 @@ impl ColdStartFixture {
         Self {
             tree,
             configuration,
+            persistent_domain,
             runtime_domain,
+            prepared_lower: lower,
             catalog,
             store,
             artifact,