Decompose oversized Rust files by responsibility
This commit is contained in:
parent
03bfe92ca0
commit
ee9201b057
1 changed files with 18648 additions and 18513 deletions
|
|
@ -0,0 +1,520 @@
|
|||
struct Fixture {
|
||||
_tree: Option<TempDir>,
|
||||
configuration: ResolvedDomainConfiguration,
|
||||
store: Arc<HostCoordinatorDomainStore>,
|
||||
bundle: SandboxBundle,
|
||||
activity: PathBuf,
|
||||
benchmark_results: Option<PathBuf>,
|
||||
}
|
||||
|
||||
impl Fixture {
|
||||
fn new() -> Result<Self, MatrixError> {
|
||||
let tree = tempfile::tempdir()?;
|
||||
let root = tree.path().to_path_buf();
|
||||
Self::build(&root, Some(tree))
|
||||
}
|
||||
|
||||
fn in_directory(root: &Path) -> Result<Self, MatrixError> {
|
||||
Self::build(root, None)
|
||||
}
|
||||
|
||||
#[allow(clippy::too_many_arguments)]
|
||||
fn build_benchmark(
|
||||
root: &Path,
|
||||
workspace: &Path,
|
||||
host_root: &Path,
|
||||
output: &Path,
|
||||
repository: &Path,
|
||||
cargo_home: &Path,
|
||||
rustup_home: &Path,
|
||||
uv_bin: &Path,
|
||||
sample_arguments: &[std::ffi::OsString],
|
||||
) -> Result<Self, MatrixError> {
|
||||
let configuration_directory = root.join("configuration");
|
||||
let runtime = root.join("runtime");
|
||||
for directory in [&configuration_directory, &runtime] {
|
||||
fs::create_dir_all(directory)?;
|
||||
}
|
||||
let configuration_path = configuration_directory.join("lazaret.toml");
|
||||
let paths = [
|
||||
root,
|
||||
workspace,
|
||||
host_root,
|
||||
output,
|
||||
repository,
|
||||
cargo_home,
|
||||
rustup_home,
|
||||
uv_bin,
|
||||
];
|
||||
if paths.iter().any(|path| {
|
||||
path.to_str()
|
||||
.is_none_or(|value| value.contains(['\n', '\r', '"']))
|
||||
}) {
|
||||
return Err(failure("benchmark composition path is not TOML-safe"));
|
||||
}
|
||||
fs::write(
|
||||
&configuration_path,
|
||||
format!(
|
||||
"schema = \"lazaret-trusted-host-config-v1\"\n\n[storage]\ndata_root = \"{}\"\n\n[network]\ndefault_allow = [\"192.0.2.10/32\"]\n\n[profiles.default]\nimage = \"example.invalid/runtime-fixture:v1\"\npersistent_dirs = [\"/tooling\", \"/fixtures\"]\nenv = {{ PATH = \"env:BENCHMARK_PATH\", CARGO_HOME = \"env:BENCHMARK_CARGO_HOME\", RUSTUP_HOME = \"env:BENCHMARK_RUSTUP_HOME\", CARGO_BUILD_JOBS = \"env:BENCHMARK_CARGO_BUILD_JOBS\" }}\nvolumes = [\n {{ host = \"{}\", container = \"/tooling/usr\", kind = \"directory\", access = \"read-only\" }},\n {{ host = \"{}\", container = \"/fixtures/host\", kind = \"directory\", access = \"read-only\" }},\n {{ host = \"{}\", container = \"/fixtures/output\", kind = \"directory\", access = \"read-write\" }},\n {{ host = \"{}\", container = \"/fixtures/repository\", kind = \"directory\", access = \"read-only\" }},\n {{ host = \"{}\", container = \"/tooling/cargo\", kind = \"directory\", access = \"read-only\" }},\n {{ host = \"{}\", container = \"/tooling/rustup\", kind = \"directory\", access = \"read-only\" }},\n {{ host = \"{}\", container = \"/tooling/uv-bin\", kind = \"directory\", access = \"read-only\" }},\n]\n\n[profiles.default.readiness]\ndenied = [{{ address = \"10.20.30.40\", port = 443 }}]\npermitted = [{{ address = \"192.0.2.10\", port = 443 }}]\ndns = [{{ resolver = \"198.51.100.53\", query = \"example.invalid\" }}]\n",
|
||||
root.join("data").display(),
|
||||
Path::new("/usr").display(),
|
||||
host_root.display(),
|
||||
output.display(),
|
||||
repository.display(),
|
||||
cargo_home.display(),
|
||||
rustup_home.display(),
|
||||
uv_bin.display(),
|
||||
),
|
||||
)?;
|
||||
let environment = BTreeMap::from([
|
||||
(
|
||||
"BENCHMARK_PATH".into(),
|
||||
"/tooling/cargo/bin:/tooling/uv-bin:/usr/bin:/bin".into(),
|
||||
),
|
||||
("BENCHMARK_CARGO_HOME".into(), "/tooling/cargo".into()),
|
||||
("BENCHMARK_RUSTUP_HOME".into(), "/tooling/rustup".into()),
|
||||
("BENCHMARK_CARGO_BUILD_JOBS".into(), "2".into()),
|
||||
]);
|
||||
let configuration = load_trusted_configuration(ConfigurationLoadRequest {
|
||||
explicit_configuration_path: Some(configuration_path),
|
||||
selected_profile: "default".into(),
|
||||
workspace: workspace.to_path_buf(),
|
||||
home: root.join("home"),
|
||||
xdg_config_home: None,
|
||||
xdg_data_home: None,
|
||||
xdg_runtime_dir: runtime,
|
||||
environment,
|
||||
sandbox_layout: default_sandbox_layout().map_err(failure)?,
|
||||
})
|
||||
.map_err(failure)?;
|
||||
let runtime_domain = host_path(configuration.runtime_domain_root().canonical_label());
|
||||
let results = output.to_path_buf();
|
||||
stage_benchmark_rootfs_and_control(&runtime_domain)?;
|
||||
let mut guest_arguments = vec![
|
||||
BENCHMARK_GUEST.to_owned(),
|
||||
"/fixtures/output".to_owned(),
|
||||
"/usr/bin/python3".to_owned(),
|
||||
"/fixtures/repository/tools/ignored_workspace_benchmark.py".to_owned(),
|
||||
"sample".to_owned(),
|
||||
];
|
||||
guest_arguments.extend(
|
||||
sample_arguments
|
||||
.iter()
|
||||
.map(|argument| argument.to_string_lossy().into_owned()),
|
||||
);
|
||||
let root_process =
|
||||
RootProcess::new("/bin/runtime-composition", guest_arguments).map_err(failure)?;
|
||||
let namespace =
|
||||
lazaret_linux::filesystem::namespace_identity(Path::new(NETWORK_NAMESPACE_PATH))?;
|
||||
let bundle = build_sandbox_bundle(SandboxBuildRequest {
|
||||
configuration: &configuration,
|
||||
container_id: ContainerId::new([6; 32]),
|
||||
expected_network_namespace: namespace,
|
||||
root_process,
|
||||
terminal: None,
|
||||
prepared_root: runtime_domain.join("prepared-root"),
|
||||
})
|
||||
.map_err(failure)?;
|
||||
Self::finish_build(
|
||||
None,
|
||||
configuration,
|
||||
bundle,
|
||||
workspace.join("activity"),
|
||||
Some(results),
|
||||
)
|
||||
}
|
||||
|
||||
fn build(root: &Path, tree: Option<TempDir>) -> Result<Self, MatrixError> {
|
||||
let configuration_directory = root.join("configuration");
|
||||
let workspace = root.join("workspace");
|
||||
let runtime = root.join("runtime");
|
||||
fs::create_dir(&configuration_directory)?;
|
||||
fs::create_dir(&workspace)?;
|
||||
fs::create_dir(&runtime)?;
|
||||
let configuration_path = configuration_directory.join("lazaret.toml");
|
||||
fs::write(
|
||||
&configuration_path,
|
||||
format!(
|
||||
"schema = \"lazaret-trusted-host-config-v1\"\n\n[storage]\ndata_root = \"{}\"\n\n[network]\ndefault_allow = [\"192.0.2.10/32\"]\n\n[profiles.default]\nimage = \"example.invalid/runtime-fixture:v1\"\npersistent_dirs = []\n\n[profiles.default.readiness]\ndenied = [{{ address = \"10.20.30.40\", port = 443 }}]\npermitted = [{{ address = \"192.0.2.10\", port = 443 }}]\ndns = [{{ resolver = \"198.51.100.53\", query = \"example.invalid\" }}]\n",
|
||||
root.join("data").display()
|
||||
),
|
||||
)?;
|
||||
let configuration = load_trusted_configuration(ConfigurationLoadRequest {
|
||||
explicit_configuration_path: Some(configuration_path),
|
||||
selected_profile: "default".into(),
|
||||
workspace: workspace.clone(),
|
||||
home: root.join("home"),
|
||||
xdg_config_home: None,
|
||||
xdg_data_home: None,
|
||||
xdg_runtime_dir: runtime,
|
||||
environment: BTreeMap::new(),
|
||||
sandbox_layout: default_sandbox_layout().map_err(failure)?,
|
||||
})
|
||||
.map_err(failure)?;
|
||||
let runtime_domain = host_path(configuration.runtime_domain_root().canonical_label());
|
||||
let container_id = ContainerId::new([6; 32]);
|
||||
stage_rootfs_and_control(&runtime_domain, container_id)?;
|
||||
let root_process = RootProcess::new(
|
||||
"/bin/sh",
|
||||
[
|
||||
"-c".to_owned(),
|
||||
"while :; do echo x >> /workspace/activity; /bin/sleep 0.02; done".to_owned(),
|
||||
],
|
||||
)
|
||||
.map_err(failure)?;
|
||||
let namespace =
|
||||
lazaret_linux::filesystem::namespace_identity(Path::new(NETWORK_NAMESPACE_PATH))?;
|
||||
let bundle = build_sandbox_bundle(SandboxBuildRequest {
|
||||
configuration: &configuration,
|
||||
container_id,
|
||||
expected_network_namespace: namespace,
|
||||
root_process,
|
||||
terminal: None,
|
||||
prepared_root: runtime_domain.join("prepared-root"),
|
||||
})
|
||||
.map_err(failure)?;
|
||||
Self::finish_build(
|
||||
tree,
|
||||
configuration,
|
||||
bundle,
|
||||
workspace.join("activity"),
|
||||
None,
|
||||
)
|
||||
}
|
||||
|
||||
fn finish_build(
|
||||
tree: Option<TempDir>,
|
||||
configuration: ResolvedDomainConfiguration,
|
||||
bundle: SandboxBundle,
|
||||
activity: PathBuf,
|
||||
benchmark_results: Option<PathBuf>,
|
||||
) -> Result<Self, MatrixError> {
|
||||
let runtime_domain = host_path(configuration.runtime_domain_root().canonical_label());
|
||||
let container_id = ContainerId::new([6; 32]);
|
||||
let bundle_path = runtime_domain
|
||||
.join("bundles")
|
||||
.join(hex(container_id.as_bytes()));
|
||||
fs::create_dir_all(&bundle_path)?;
|
||||
fs::write(bundle_path.join("config.json"), bundle.specification_json())?;
|
||||
fs::create_dir_all(runtime_domain.join("runsc"))?;
|
||||
let domain = Domain {
|
||||
domain_id: configuration.domain_id(),
|
||||
profile_name: configuration.selected_profile().to_owned(),
|
||||
canonical_workspace: configuration.workspace().canonical_label().clone(),
|
||||
};
|
||||
let persistent_domain = host_path(configuration.persistent_domain_root().canonical_label());
|
||||
let lock = try_exclusive_flock(lock_file(&persistent_domain.join("domain.lock")))?;
|
||||
let store = Arc::new(
|
||||
HostCoordinatorDomainStore::open(lock, &persistent_domain.join("domain.redb"), &domain)
|
||||
.map_err(failure)?,
|
||||
);
|
||||
store
|
||||
.apply(&[DomainStoreMutation::PutGeneration(Generation {
|
||||
domain_id: configuration.domain_id(),
|
||||
generation_id: GenerationId::new(7),
|
||||
configuration_fingerprint: configuration.configuration_fingerprint(),
|
||||
coordinator_id: CoordinatorId::new([3; 32]),
|
||||
network_sidecar_id: NetworkSidecarId::new([4; 32]),
|
||||
sandbox_id: SandboxId::new([5; 32]),
|
||||
durable_decision: DurableDecision::None,
|
||||
})])
|
||||
.map_err(failure)?;
|
||||
SandboxCoordinator::new(&store)
|
||||
.begin_intent(
|
||||
GenerationId::new(7),
|
||||
container_id,
|
||||
&runtime_domain.join("runsc"),
|
||||
current_mount_identity(&runtime_domain.join("runsc"))?,
|
||||
BundleDigest::new([7; 32]),
|
||||
current_process_identity()?,
|
||||
)
|
||||
.map_err(failure)?;
|
||||
Ok(Self {
|
||||
_tree: tree,
|
||||
configuration,
|
||||
store,
|
||||
bundle,
|
||||
activity,
|
||||
benchmark_results,
|
||||
})
|
||||
}
|
||||
|
||||
fn launch_pending(&self) -> Result<AwaitingAttachedRunsc, MatrixError> {
|
||||
self.launch_pending_with_command(self.bundle.command())
|
||||
}
|
||||
|
||||
fn launch_pending_with_command(
|
||||
&self,
|
||||
command: &RunscCommand,
|
||||
) -> Result<AwaitingAttachedRunsc, MatrixError> {
|
||||
let launch = RuntimeSupervisorLaunch::from_runsc_command(
|
||||
ProcessOwnershipContext {
|
||||
domain_id: self.configuration.domain_id(),
|
||||
generation_id: GenerationId::new(7),
|
||||
coordinator_id: CoordinatorId::new([3; 32]),
|
||||
slot: lazaret_core::records::HostProcessOwnershipSlot::SandboxRuntimeSupervisor,
|
||||
},
|
||||
command,
|
||||
)?;
|
||||
AwaitingAttachedRunsc::launch(&SandboxCoordinator::new(&self.store), &launch)
|
||||
.map_err(failure)
|
||||
}
|
||||
|
||||
fn alternate_bundle(&self) -> Result<SandboxBundle, MatrixError> {
|
||||
let namespace =
|
||||
lazaret_linux::filesystem::namespace_identity(Path::new(NETWORK_NAMESPACE_PATH))?;
|
||||
build_sandbox_bundle(SandboxBuildRequest {
|
||||
configuration: &self.configuration,
|
||||
container_id: ContainerId::new([6; 32]),
|
||||
expected_network_namespace: namespace,
|
||||
root_process: RootProcess::new(
|
||||
"/bin/sh",
|
||||
[
|
||||
"-c".to_owned(),
|
||||
"echo cross-bundle >> /workspace/activity".to_owned(),
|
||||
],
|
||||
)
|
||||
.map_err(failure)?,
|
||||
terminal: None,
|
||||
prepared_root: host_path(self.configuration.runtime_domain_root().canonical_label())
|
||||
.join("prepared-root"),
|
||||
})
|
||||
.map_err(failure)
|
||||
}
|
||||
|
||||
fn launch_committed(&self) -> Result<CommittedSandboxRuntime, MatrixError> {
|
||||
let handoff = self
|
||||
.bundle
|
||||
.capture_handoff_authority(&self.configuration)
|
||||
.map_err(failure)?;
|
||||
let mut pending = self.launch_pending()?;
|
||||
let staged = pending
|
||||
.receive_staged(&SandboxCoordinator::new(&self.store))
|
||||
.map_err(failure)?;
|
||||
pending
|
||||
.acknowledge(staged, &handoff)
|
||||
.map_err(failure)?
|
||||
.commit(&SandboxCoordinator::new(&self.store))
|
||||
.map_err(failure)
|
||||
}
|
||||
}
|
||||
|
||||
struct NetworkFixture {
|
||||
_tree: TempDir,
|
||||
_host_loopback: TcpListener,
|
||||
_host_abstract: UnixListener,
|
||||
configuration: ResolvedDomainConfiguration,
|
||||
store: HostCoordinatorDomainStore,
|
||||
bundle: SandboxBundle,
|
||||
policy: lazaret_core::network::CanonicalDerivedNetworkPolicy,
|
||||
probe_result: PathBuf,
|
||||
}
|
||||
|
||||
impl NetworkFixture {
|
||||
fn new() -> Result<Self, MatrixError> {
|
||||
let tree = tempfile::tempdir()?;
|
||||
let root = tree.path();
|
||||
let workspace = root.join("workspace");
|
||||
let runtime = root.join("runtime");
|
||||
let configuration = network_configuration(root, &workspace, &runtime)?;
|
||||
let runtime_domain = host_path(configuration.runtime_domain_root().canonical_label());
|
||||
let container_id = ContainerId::new([16; 32]);
|
||||
stage_rootfs_and_control(&runtime_domain, container_id)?;
|
||||
let rootfs = runtime_domain.join("prepared-root");
|
||||
fs::copy(
|
||||
std::env::current_exe()?,
|
||||
rootfs.join("bin/lazaret-network-probe"),
|
||||
)?;
|
||||
fs::write(
|
||||
runtime_domain.join("state-anchor/runtime-files/resolv.conf"),
|
||||
b"nameserver 10.0.2.3\n",
|
||||
)?;
|
||||
let host_loopback = TcpListener::bind((Ipv4Addr::LOCALHOST, 0))?;
|
||||
let host_loopback_port = host_loopback.local_addr()?.port();
|
||||
let abstract_name = format!("lazaret-network-v3-{}", std::process::id()).into_bytes();
|
||||
let host_abstract =
|
||||
UnixListener::bind_addr(&SocketAddr::from_abstract_name(&abstract_name)?)?;
|
||||
let root_process = RootProcess::new(
|
||||
"/bin/lazaret-network-probe",
|
||||
vec![
|
||||
SANDBOX_NETWORK_PROBE.into(),
|
||||
host_loopback_port.to_string(),
|
||||
String::from_utf8(abstract_name.clone()).map_err(failure)?,
|
||||
],
|
||||
)
|
||||
.map_err(failure)?;
|
||||
let namespace =
|
||||
lazaret_linux::filesystem::namespace_identity(Path::new(NETWORK_NAMESPACE_PATH))?;
|
||||
let bundle = build_sandbox_bundle(SandboxBuildRequest {
|
||||
configuration: &configuration,
|
||||
container_id,
|
||||
expected_network_namespace: namespace,
|
||||
root_process,
|
||||
terminal: None,
|
||||
prepared_root: runtime_domain.join("prepared-root"),
|
||||
})
|
||||
.map_err(failure)?;
|
||||
let bundle_path = runtime_domain
|
||||
.join("bundles")
|
||||
.join(hex(container_id.as_bytes()));
|
||||
fs::create_dir_all(&bundle_path)?;
|
||||
fs::write(bundle_path.join("config.json"), bundle.specification_json())?;
|
||||
fs::create_dir_all(runtime_domain.join("runsc"))?;
|
||||
let store = network_store(&configuration, &runtime_domain, container_id)?;
|
||||
let policy =
|
||||
derive_ipv4_policy(&configuration, [IpAddress::V4([10, 0, 2, 3])]).map_err(failure)?;
|
||||
Ok(Self {
|
||||
_tree: tree,
|
||||
_host_loopback: host_loopback,
|
||||
_host_abstract: host_abstract,
|
||||
configuration,
|
||||
store,
|
||||
bundle,
|
||||
policy,
|
||||
probe_result: workspace.join("network-probe"),
|
||||
})
|
||||
}
|
||||
|
||||
fn launch(&self) -> Result<CommittedSandboxRuntime, MatrixError> {
|
||||
self.launch_with_permitted([1, 1, 1, 1], 443)
|
||||
}
|
||||
|
||||
fn launch_with_permitted(
|
||||
&self,
|
||||
permitted_address: [u8; 4],
|
||||
permitted_port: u16,
|
||||
) -> Result<CommittedSandboxRuntime, MatrixError> {
|
||||
let handoff = self
|
||||
.bundle
|
||||
.capture_handoff_authority(&self.configuration)
|
||||
.map_err(failure)?;
|
||||
let launch = RuntimeSupervisorLaunch::from_networked_runsc_command(
|
||||
ProcessOwnershipContext {
|
||||
domain_id: self.configuration.domain_id(),
|
||||
generation_id: GenerationId::new(7),
|
||||
coordinator_id: CoordinatorId::new([13; 32]),
|
||||
slot: HostProcessOwnershipSlot::SandboxRuntimeSupervisor,
|
||||
},
|
||||
self.bundle.command(),
|
||||
RuntimeNetworkLaunch {
|
||||
policy: &self.policy,
|
||||
configuration_fingerprint: self.configuration.configuration_fingerprint(),
|
||||
network_sidecar_id: NetworkSidecarId::new([14; 32]),
|
||||
},
|
||||
)?;
|
||||
let sandbox = SandboxCoordinator::new(&self.store);
|
||||
let network = NetworkCoordinator::new(&self.store);
|
||||
let mut pending = AwaitingAttachedRunsc::launch_networked(&sandbox, &network, &launch)
|
||||
.map_err(failure)?;
|
||||
pending.receive_helper_staged(&network).map_err(failure)?;
|
||||
pending
|
||||
.receive_network_readiness(
|
||||
&network,
|
||||
&self.policy,
|
||||
|namespace| NetworkProbeRequest {
|
||||
domain_id: self.configuration.domain_id(),
|
||||
generation_id: GenerationId::new(7),
|
||||
enforcement_namespace: namespace,
|
||||
denied: vec![TcpProbeTarget {
|
||||
address: IpAddress::V4([10, 1, 2, 3]),
|
||||
port: 443,
|
||||
}],
|
||||
permitted: vec![TcpProbeTarget {
|
||||
address: IpAddress::V4(permitted_address),
|
||||
port: permitted_port,
|
||||
}],
|
||||
dns: vec![DnsProbeTarget {
|
||||
resolver: IpAddress::V4([10, 0, 2, 3]),
|
||||
query_name: "example.com".into(),
|
||||
}],
|
||||
},
|
||||
&ReachabilityExpectation {
|
||||
denied_destinations: vec![IpAddress::V4([10, 1, 2, 3])],
|
||||
permitted_destinations: vec![IpAddress::V4(permitted_address)],
|
||||
dns_queries: vec![DnsQueryExpectation {
|
||||
resolver: IpAddress::V4([10, 0, 2, 3]),
|
||||
query_name: "example.com".into(),
|
||||
}],
|
||||
},
|
||||
)
|
||||
.map_err(failure)?;
|
||||
let staged = pending.receive_staged(&sandbox).map_err(failure)?;
|
||||
let (runtime, _) = pending
|
||||
.acknowledge(staged, &handoff)
|
||||
.map_err(failure)?
|
||||
.commit_networked(&sandbox)
|
||||
.map_err(failure)?;
|
||||
Ok(runtime)
|
||||
}
|
||||
}
|
||||
|
||||
fn network_configuration(
|
||||
root: &Path,
|
||||
workspace: &Path,
|
||||
runtime: &Path,
|
||||
) -> Result<ResolvedDomainConfiguration, MatrixError> {
|
||||
let configuration_directory = root.join("configuration");
|
||||
fs::create_dir(&configuration_directory)?;
|
||||
fs::create_dir(workspace)?;
|
||||
fs::create_dir(runtime)?;
|
||||
let configuration_path = configuration_directory.join("lazaret.toml");
|
||||
fs::write(
|
||||
&configuration_path,
|
||||
format!(
|
||||
"schema = \"lazaret-trusted-host-config-v1\"\n\n[storage]\ndata_root = \"{}\"\n\n[network]\ndefault_allow = [\"192.0.2.10/32\"]\n\n[profiles.default]\nimage = \"example.invalid/network-fixture:v1\"\npersistent_dirs = []\n\n[profiles.default.readiness]\ndenied = [{{ address = \"10.20.30.40\", port = 443 }}]\npermitted = [{{ address = \"192.0.2.10\", port = 443 }}]\ndns = [{{ resolver = \"198.51.100.53\", query = \"example.invalid\" }}]\n",
|
||||
root.join("data").display()
|
||||
),
|
||||
)?;
|
||||
load_trusted_configuration(ConfigurationLoadRequest {
|
||||
explicit_configuration_path: Some(configuration_path),
|
||||
selected_profile: "default".into(),
|
||||
workspace: workspace.to_path_buf(),
|
||||
home: root.join("home"),
|
||||
xdg_config_home: None,
|
||||
xdg_data_home: None,
|
||||
xdg_runtime_dir: runtime.to_path_buf(),
|
||||
environment: BTreeMap::new(),
|
||||
sandbox_layout: default_sandbox_layout().map_err(failure)?,
|
||||
})
|
||||
.map_err(failure)
|
||||
}
|
||||
|
||||
fn network_store(
|
||||
configuration: &ResolvedDomainConfiguration,
|
||||
runtime_domain: &Path,
|
||||
container_id: ContainerId,
|
||||
) -> Result<HostCoordinatorDomainStore, MatrixError> {
|
||||
let domain = Domain {
|
||||
domain_id: configuration.domain_id(),
|
||||
profile_name: configuration.selected_profile().to_owned(),
|
||||
canonical_workspace: configuration.workspace().canonical_label().clone(),
|
||||
};
|
||||
let persistent_domain = host_path(configuration.persistent_domain_root().canonical_label());
|
||||
let lock = try_exclusive_flock(lock_file(&persistent_domain.join("domain.lock")))?;
|
||||
let store =
|
||||
HostCoordinatorDomainStore::open(lock, &persistent_domain.join("domain.redb"), &domain)
|
||||
.map_err(failure)?;
|
||||
store
|
||||
.apply(&[DomainStoreMutation::PutGeneration(Generation {
|
||||
domain_id: configuration.domain_id(),
|
||||
generation_id: GenerationId::new(7),
|
||||
configuration_fingerprint: configuration.configuration_fingerprint(),
|
||||
coordinator_id: CoordinatorId::new([13; 32]),
|
||||
network_sidecar_id: NetworkSidecarId::new([14; 32]),
|
||||
sandbox_id: SandboxId::new([15; 32]),
|
||||
durable_decision: DurableDecision::None,
|
||||
})])
|
||||
.map_err(failure)?;
|
||||
SandboxCoordinator::new(&store)
|
||||
.begin_intent(
|
||||
GenerationId::new(7),
|
||||
container_id,
|
||||
&runtime_domain.join("runsc"),
|
||||
current_mount_identity(&runtime_domain.join("runsc"))?,
|
||||
BundleDigest::new([17; 32]),
|
||||
current_process_identity()?,
|
||||
)
|
||||
.map_err(failure)?;
|
||||
Ok(store)
|
||||
}
|
||||
|
||||
Loading…
Reference in a new issue