ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Bound and configure the per-Domain runsc dcache

Browse source
This commit is contained in:
ms2k 2026-07-24 23:34:02 +09:00
commit db9a561d0c
3 changed files with 157 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

6
crates/lazaret-runtime-supervisor/src/sandbox.rs
View file

@ -693,7 +693,11 @@ fn build_sandbox_bundle_from_source(
.map_err(oci_error)?;
let specification_json = canonical_specification_json(&specification)?;
let bundle_authorization = Sha256::digest(&specification_json).into();
let command = build_runsc_command(&paths, bundle_authorization);
let command = build_runsc_command(
&paths,
request.configuration.runsc_dcache(),
bundle_authorization,
);
let runtime_sources =
handoff_runtime_sources(&paths, request.terminal.as_ref(), &specification_json);
Ok(SandboxBundle {

2
crates/lazaret-runtime-supervisor/src/sandbox/runtime_sources.rs
View file

@ -278,6 +278,7 @@ pub(super) fn build_linux() -> Result<oci_spec::runtime::Linux, SandboxBuildErro
pub(super) fn build_runsc_command(
paths: &RuntimePaths,
dcache: u32,
bundle_authorization: [u8; 32],
) -> RunscCommand {
RunscCommand::new(
@ -292,6 +293,7 @@ pub(super) fn build_runsc_command(
)),
OsString::from("-network=host"),
OsString::from("-ignore-cgroups"),
OsString::from(format!("-dcache={dcache}")),
OsString::from(format!(
"-overlay2=root:dir={}",
paths

34
crates/lazaret-runtime-supervisor/tests/sandbox_builder.rs
View file

@ -373,6 +373,7 @@ fn assert_runtime_command(bundle: &SandboxBundle, fixture: &Fixture) {
format!("-root={runtime_domain}/runsc"),
"-network=host".to_owned(),
"-ignore-cgroups".to_owned(),
"-dcache=50000".to_owned(),
format!(
"-overlay2=root:dir={runtime_domain}/runsc-overlay/{}",
"11".repeat(32)
@ -402,6 +403,39 @@ fn assert_runtime_command(bundle: &SandboxBundle, fixture: &Fixture) {
}));
}
#[test]
fn configured_dcache_is_fingerprinted_and_passed_to_runsc() {
let fixture = Fixture::new();
let configuration_path = fixture.tree.path().join("configuration/lazaret.toml");
let source = fs::read_to_string(&configuration_path).unwrap();
fs::write(
&configuration_path,
source.replace("[network]", "[runtime]\nrunsc_dcache = 12345\n\n[network]"),
)
.unwrap();
let configuration = fixture.reload_configuration();
assert_eq!(configuration.runsc_dcache(), 12_345);
assert_ne!(
configuration.configuration_fingerprint(),
fixture.configuration.configuration_fingerprint()
);
let bundle = build_sandbox_bundle(SandboxBuildRequest {
configuration: &configuration,
container_id: ContainerId::new([0x11; 32]),
expected_network_namespace: current_network_namespace(),
root_process: root_process([]),
terminal: None,
prepared_root: fixture.tree.path().join("prepared-root"),
})
.unwrap();
assert!(
bundle
.command()
.arguments()
.contains(&"-dcache=12345".into())
);
}
#[test]
fn product_init_role_has_exact_terminal_neutral_rootless_bundle_shape() {
let fixture = Fixture::new();