ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Centralize sandbox destination authority

Browse source
This commit is contained in:
ms2k 2026-07-19 04:36:44 +09:00
commit f8849cdb5f
1 changed files with 112 additions and 48 deletions
Download patch file Download diff file Expand all files Collapse all files

12
crates/lazaret-runtime-supervisor/src/sandbox/mounts.rs
View file

@ -1,8 +1,13 @@
fn standard_mounts() -> Result<Vec<Mount>, SandboxBuildError> {
[
("/proc", "proc", "proc", vec!["nosuid", "noexec", "nodev"]),
(
"/dev",
PROC_DESTINATION,
"proc",
"proc",
vec!["nosuid", "noexec", "nodev"],
),
(
DEV_DESTINATION,
"tmpfs",
"tmpfs",
vec!["nosuid", "strictatime", "mode=755", "size=65536k"],
@ -32,7 +37,7 @@ fn standard_mounts() -> Result<Vec<Mount>, SandboxBuildError> {
vec!["nosuid", "noexec", "nodev"],
),
(
"/sys",
SYS_DESTINATION,
"sysfs",
"sysfs",
vec!["nosuid", "noexec", "nodev", "ro"],
@ -107,4 +112,3 @@ fn bind_mount(
.build()
.map_err(oci_error)
}