Bound and configure the per-Domain runsc dcache

crates/lazaret-core/tests/configuration.rs

@@ -13,8 +13,8 @@ use lazaret_core::configuration::{
 };
 use lazaret_core::identity::HostPath;
 use lazaret_core::records::{
-    ConfigurationFingerprintRecordV1, EnvironmentReference, ResolvedAutoApprovalRule,
-    ResolvedVolume, VolumeAccess, VolumeKind,
+    ConfigurationFingerprintRecordV1, DEFAULT_RUNSC_DCACHE, EnvironmentReference, MAX_RUNSC_DCACHE,
+    ResolvedAutoApprovalRule, ResolvedVolume, VolumeAccess, VolumeKind,
 };
 use static_assertions::assert_not_impl_any;
 
@@ -150,6 +150,7 @@ image = "example.invalid/agent:v1"
     assert!(parsed.storage().data_root.is_none());
     assert!(parsed.network().default_allow.is_empty());
     assert!(parsed.network().default_deny.is_empty());
+    assert_eq!(parsed.runtime().runsc_dcache, DEFAULT_RUNSC_DCACHE);
 
     for (value, expected) in [
         ("[]", Vec::<String>::new()),
@@ -212,6 +213,47 @@ volumes = [{ host = "/source", container = "/root/source", kind = "socket" }]
     }
 }
 
+#[test]
+fn runtime_dcache_defaults_accepts_budget_bounds_and_rejects_excess() {
+    let minimal = r#"schema = "lazaret-trusted-host-config-v1"
+[profiles.default]
+image = "example.invalid/agent:v1"
+"#;
+    assert_eq!(
+        parse_trusted_configuration(minimal.as_bytes())
+            .unwrap()
+            .runtime()
+            .runsc_dcache,
+        DEFAULT_RUNSC_DCACHE
+    );
+    for value in [0, MAX_RUNSC_DCACHE] {
+        let explicit = minimal.replace(
+            "[profiles.default]",
+            &format!("[runtime]\nrunsc_dcache = {value}\n[profiles.default]"),
+        );
+        assert_eq!(
+            parse_trusted_configuration(explicit.as_bytes())
+                .unwrap()
+                .runtime()
+                .runsc_dcache,
+            value
+        );
+    }
+    let excessive = minimal.replace(
+        "[profiles.default]",
+        &format!(
+            "[runtime]\nrunsc_dcache = {}\n[profiles.default]",
+            MAX_RUNSC_DCACHE + 1
+        ),
+    );
+    assert_eq!(
+        parse_trusted_configuration(excessive.as_bytes())
+            .unwrap_err()
+            .kind(),
+        ConfigurationErrorKind::InvalidRuntime
+    );
+}
+
 #[test]
 fn sandbox_layout_is_closed_normalized_and_requires_workspace() {
     assert!(SandboxLayoutV1::from_protected_destinations(["/proc".into()]).is_err());
@@ -834,6 +876,7 @@ fn digest_vectors_are_framed_and_order_independent() {
         selected_profile: "default".into(),
         storage_root: HostPath::new(b"/data".to_vec()),
         runtime_root: HostPath::new(b"/run/user/1000/lazaret".to_vec()),
+        runsc_dcache: DEFAULT_RUNSC_DCACHE,
         image: "example.invalid/agent:v1".into(),
         isolate_gitignored: true,
         persistent_dirs: vec!["/var".into(), "/root".into()],
@@ -867,9 +910,9 @@ fn digest_vectors_are_framed_and_order_independent() {
     assert_eq!(
         first.as_bytes(),
         &[
-            0xd3, 0xba, 0xef, 0x91, 0x21, 0x0f, 0x98, 0x31, 0x6c, 0xea, 0x34, 0xfb, 0x41, 0xbd,
-            0x6c, 0xa5, 0x07, 0xf0, 0xb8, 0x9b, 0x90, 0x77, 0xaf, 0x0a, 0x0e, 0xd0, 0x6a, 0xd6,
-            0x46, 0xc7, 0x2d, 0xbf,
+            0x5f, 0x1d, 0xeb, 0x46, 0xa4, 0xb5, 0x90, 0xc3, 0x47, 0x0b, 0xa0, 0xdf, 0xd6, 0x6e,
+            0x9d, 0x91, 0xdb, 0xf3, 0x75, 0xf6, 0xbe, 0x50, 0x9a, 0x8d, 0xba, 0x4a, 0x3d, 0xae,
+            0xf3, 0x05, 0x97, 0x56,
         ]
     );
     record.persistent_dirs.reverse();