ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Bound and configure the per-Domain runsc dcache

Browse source
This commit is contained in:
ms2k 2026-07-24 23:34:02 +09:00
commit db9a561d0c
2 changed files with 157 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

1
crates/lazaret-core/src/configuration/loading.rs
View file

@ -343,6 +343,7 @@ pub fn load_trusted_configuration(
selected_profile: request.selected_profile.clone(),
storage_root: host_path(&storage_canonical),
runtime_root: host_path(&runtime_canonical),
runsc_dcache: configuration.runtime().runsc_dcache,
image: selected.image.clone(),
isolate_gitignored: selected.isolate_gitignored,
persistent_dirs,

9
crates/lazaret-core/src/configuration/validation.rs
View file

@ -4,7 +4,7 @@ use super::confined_io::{
};
use super::{
ConfigurationError, ConfigurationErrorKind, ConfigurationFingerprint,
ConfigurationFingerprintRecordV1, Digest, DomainId, Sha256,
ConfigurationFingerprintRecordV1, Digest, DomainId, MAX_RUNSC_DCACHE, Sha256,
TRUSTED_HOST_CONFIGURATION_SCHEMA_ID, TrustedHostConfigurationV1,
};
@ -33,6 +33,7 @@ pub fn derive_configuration_fingerprint(
push_bytes(&mut preimage, record.selected_profile.as_bytes())?;
push_bytes(&mut preimage, record.storage_root.as_bytes())?;
push_bytes(&mut preimage, record.runtime_root.as_bytes())?;
preimage.extend_from_slice(&record.runsc_dcache.to_be_bytes());
push_bytes(&mut preimage, record.image.as_bytes())?;
push_bool(&mut preimage, record.isolate_gitignored);
@ -87,6 +88,12 @@ pub(super) fn validate_structural_configuration(
"unknown configuration schema",
));
}
if configuration.runtime().runsc_dcache > MAX_RUNSC_DCACHE {
return Err(ConfigurationError::new(
ConfigurationErrorKind::InvalidRuntime,
format!("runsc_dcache exceeds {MAX_RUNSC_DCACHE} entries"),
));
}
for (name, profile) in configuration.profiles() {
validate_profile_name(name)?;
validate_text(&profile.image, "profile image")?;