ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Remove phase vocabulary from Lazaret interfaces

Browse source
This commit is contained in:
ms2k 2026-07-18 22:35:48 +09:00
commit e7dd95aea6
2 changed files with 547 additions and 579 deletions
Download patch file Download diff file Expand all files Collapse all files

6
crates/lazaret-runtime-supervisor/src/sandbox.rs
View file

@ -603,8 +603,8 @@ impl SandboxBundle {
///
/// # Errors
/// Returns an error if the fixed layout violates the configuration layout contract.
pub fn production_sandbox_layout() -> Result<SandboxLayoutV1, SandboxBuildError> {
SandboxLayoutV1::from_production_layout([
pub fn default_sandbox_layout() -> Result<SandboxLayoutV1, SandboxBuildError> {
SandboxLayoutV1::from_protected_destinations([
WORKSPACE_DESTINATION.to_owned(),
CONTROL_ROOT_DESTINATION.to_owned(),
"/proc".to_owned(),
@ -614,7 +614,7 @@ pub fn production_sandbox_layout() -> Result<SandboxLayoutV1, SandboxBuildError>
.map_err(|error| {
SandboxBuildError::new(
SandboxBuildErrorKind::InvalidPath,
format!("production layout is invalid: {error}"),
format!("default sandbox layout is invalid: {error}"),
)
})
}

10
crates/lazaret-runtime-supervisor/tests/sandbox_builder.rs
View file

@ -13,7 +13,7 @@ use lazaret_runtime_supervisor::sandbox::{
MAILBOX_REQUESTS_DESTINATION, MAILBOX_RESULTS_DESTINATION, NETWORK_NAMESPACE_PATH, RootProcess,
SANDBOX_INIT_DESTINATION, SandboxBuildErrorKind, SandboxBuildRequest, SandboxBundle,
TERMINFO_ROOT_DESTINATION, WORKSPACE_DESTINATION, build_sandbox_bundle,
build_sandbox_bundle_with_workspace, production_sandbox_layout, stage_host_terminal,
build_sandbox_bundle_with_workspace, default_sandbox_layout, stage_host_terminal,
};
use serde_json::Value;
use tempfile::TempDir;
@ -81,7 +81,7 @@ env = {{ UNSELECTED_SECRET = "env:UNSELECTED_HOST_SECRET" }}
xdg_data_home: None,
xdg_runtime_dir: runtime,
environment,
sandbox_layout: production_sandbox_layout().unwrap(),
sandbox_layout: default_sandbox_layout().unwrap(),
})
.unwrap();
let terminfo_source = tree
@ -122,7 +122,7 @@ env = {{ UNSELECTED_SECRET = "env:UNSELECTED_HOST_SECRET" }}
("SELECTED_HOST_SECRET".to_owned(), "selected-value".into()),
("UNSELECTED_HOST_SECRET".to_owned(), "must-not-enter".into()),
]),
sandbox_layout: production_sandbox_layout().unwrap(),
sandbox_layout: default_sandbox_layout().unwrap(),
})
.unwrap()
}
@ -643,8 +643,8 @@ fn invalid_processes_and_wrong_network_identity_fail_closed() {
}
#[test]
fn production_layout_reserves_every_mount_root() {
let layout = production_sandbox_layout().unwrap();
fn default_layout_reserves_every_mount_root() {
let layout = default_sandbox_layout().unwrap();
assert_eq!(
layout.protected_destinations(),
&BTreeSet::from([