ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Give non-network runtime fixtures an isolated namespace

Browse source
This commit is contained in:
ms2k 2026-07-17 14:36:40 +09:00
commit cb6f6dc465
3 changed files with 7 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

3
crates/lazaret-host-coordinator/tests/runtime-composition.rs
View file

@ -261,8 +261,7 @@ fn run_matrix() -> Result<(), MatrixError> {
normal_stop_and_stop_resume()?; normal_stop_and_stop_resume()?;
attached_runsc_loss_stops_guest()?; attached_runsc_loss_stops_guest()?;
runtime_supervisor_loss_stops_guest()?; runtime_supervisor_loss_stops_guest()?;
host_coordinator_loss_stops_guest()?; host_coordinator_loss_stops_guest()
run_network_cases()
} }
fn run_network_matrix() -> Result<(), MatrixError> { fn run_network_matrix() -> Result<(), MatrixError> {

2
crates/lazaret-runtime-supervisor/src/network.rs
View file

@ -234,7 +234,7 @@ pub(crate) fn enter_generation_filesystem_namespaces()
} }
#[allow(deprecated)] #[allow(deprecated)]
fn enter_generation_network_namespace() -> io::Result<()> { pub(crate) fn enter_generation_network_namespace() -> io::Result<()> {
rustix::thread::unshare(UnshareFlags::NEWNET)?; rustix::thread::unshare(UnshareFlags::NEWNET)?;
Ok(()) Ok(())
} }

6
crates/lazaret-runtime-supervisor/src/supervision.rs
View file

@ -35,7 +35,8 @@ use serde::{Deserialize, Serialize};
use crate::network::{ use crate::network::{
NetworkAttestationContext, NetworkProbeRequest, PreparedNetwork, NetworkAttestationContext, NetworkProbeRequest, PreparedNetwork,
enter_generation_filesystem_namespaces, prepare_network, probe_current_network, enter_generation_filesystem_namespaces, enter_generation_network_namespace, prepare_network,
probe_current_network,
}; };
use crate::sandbox::RunscCommand; use crate::sandbox::RunscCommand;
@ -684,6 +685,9 @@ fn parse_fixed_hex(value: &OsStr) -> io::Result<[u8; 32]> {
fn run_supervisor(arguments: &RuntimeArguments) -> io::Result<()> { fn run_supervisor(arguments: &RuntimeArguments) -> io::Result<()> {
require_lifetime_held()?; require_lifetime_held()?;
let namespaces = enter_generation_filesystem_namespaces()?; let namespaces = enter_generation_filesystem_namespaces()?;
if arguments.network.is_none() {
enter_generation_network_namespace()?;
}
let control = std::io::stdout(); let control = std::io::stdout();
let parent = current_process_identity()?; let parent = current_process_identity()?;
let mut state_anchor = prepare_state_anchor(arguments, parent, namespaces, &control)?; let mut state_anchor = prepare_state_anchor(arguments, parent, namespaces, &control)?;