ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Bind production cold start to installed Lazaret authorities

Browse source
This commit is contained in:
ms2k 2026-07-16 20:41:40 +09:00
commit bc04112c77
1 changed files with 573 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

70
crates/lazaret-runtime-supervisor/tests/sandbox_builder.rs
View file

@ -11,8 +11,9 @@ use lazaret_core::identity::{ContainerId, DeviceId, InodeId, NamespaceIdentity};
use lazaret_runtime_supervisor::sandbox::{
CREDENTIALS_DESTINATION, ESCALATION_CLIENT_DESTINATION, HostTerminal,
MAILBOX_REQUESTS_DESTINATION, MAILBOX_RESULTS_DESTINATION, NETWORK_NAMESPACE_PATH, RootProcess,
SandboxBuildErrorKind, SandboxBuildRequest, TERMINFO_ROOT_DESTINATION, WORKSPACE_DESTINATION,
build_sandbox_bundle, production_sandbox_layout, stage_host_terminal,
SANDBOX_INIT_DESTINATION, SandboxBuildErrorKind, SandboxBuildRequest,
TERMINFO_ROOT_DESTINATION, WORKSPACE_DESTINATION, build_sandbox_bundle,
production_sandbox_layout, stage_host_terminal,
};
use serde_json::Value;
use tempfile::TempDir;
@ -41,6 +42,9 @@ impl Fixture {
[storage]
data_root = "{}"
[network]
default_allow = ["192.0.2.10/32"]
[profiles.default]
image = "example.invalid/agent:v1"
persistent_dirs = ["/root"]
@ -50,6 +54,11 @@ volumes = [
{{ host = "{{profile_dir}}/read-write", container = "/root/read-write", kind = "directory", access = "read-write", create = true }},
]
[profiles.default.readiness]
denied = [{{ address = "10.20.30.40", port = 443 }}]
permitted = [{{ address = "192.0.2.10", port = 443 }}]
dns = [{{ resolver = "198.51.100.53", query = "example.invalid" }}]
[profiles.unselected]
image = "example.invalid/unselected:v1"
env = {{ UNSELECTED_SECRET = "env:UNSELECTED_HOST_SECRET" }}
@ -172,6 +181,13 @@ env = {{ UNSELECTED_SECRET = "env:UNSELECTED_HOST_SECRET" }}
b"executable",
)
.unwrap();
fs::write(
runtime.join(format!(
"sandbox-control/{container}/bin/lazaret-sandbox-init"
)),
b"executable",
)
.unwrap();
}
fn bundle_config_path(&self) -> PathBuf {
@ -274,11 +290,15 @@ fn deterministic_snapshot_has_only_private_namespaces_and_fixed_runtime_shape()
assert_eq!(namespaces[5]["path"], NETWORK_NAMESPACE_PATH);
assert_eq!(
specification["linux"]["uidMappings"],
serde_json::json!([{ "hostID": 0, "containerID": 0, "size": 1 }])
serde_json::json!([{
"hostID": rustix::process::getuid().as_raw(), "containerID": 0, "size": 1
}])
);
assert_eq!(
specification["linux"]["gidMappings"],
serde_json::json!([{ "hostID": 0, "containerID": 0, "size": 1 }])
serde_json::json!([{
"hostID": rustix::process::getgid().as_raw(), "containerID": 0, "size": 1
}])
);
assert_eq!(first.command().program(), OsStr::new("runsc"));
@ -328,6 +348,48 @@ fn deterministic_snapshot_has_only_private_namespaces_and_fixed_runtime_shape()
}));
}
#[test]
fn product_init_role_has_exact_terminal_neutral_rootless_bundle_shape() {
let fixture = Fixture::new();
let root = RootProcess::new(
SANDBOX_INIT_DESTINATION,
["--lazaret-private-sandbox-init-v1".to_owned()],
)
.unwrap();
let specification = value(&build_sandbox_bundle(fixture.request(root)).unwrap());
assert_eq!(specification["process"]["terminal"], false);
assert_eq!(
specification["process"]["args"],
serde_json::json!([
SANDBOX_INIT_DESTINATION,
"--lazaret-private-sandbox-init-v1"
])
);
assert_eq!(specification["process"]["user"]["uid"], 0);
assert_eq!(specification["process"]["user"]["gid"], 0);
assert_eq!(
specification["linux"]["uidMappings"],
serde_json::json!([{
"hostID": rustix::process::getuid().as_raw(), "containerID": 0, "size": 1
}])
);
assert_eq!(
mounts(&specification)[SANDBOX_INIT_DESTINATION]["source"],
host_path(
fixture
.configuration
.runtime_domain_root()
.canonical_label()
.as_bytes(),
)
.join("sandbox-control")
.join("11".repeat(32))
.join("bin/lazaret-sandbox-init")
.display()
.to_string()
);
}
#[test]
fn selected_environment_volume_modes_and_host_terminal_are_preserved() {
let fixture = Fixture::new();