12ab7ea3b4
hst/fs: access ops through interface
...
This removes the final hakurei.app/container import from hst.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-07 23:59:48 +09:00
584ce3da68
container/bits: move bind bits
...
This allows referring to the bits without importing container.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-07 21:38:31 +09:00
5d18af0007
container/fhs: move pathname constants
...
This allows referencing FHS pathnames without importing container.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-07 21:29:16 +09:00
0e6c1a5026
container/check: move absolute pathname
...
This allows use of absolute pathname values without importing container.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-07 20:57:58 +09:00
3ce63e95d7
container: move seccomp preset bits
...
This allows holding the bits without cgo.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-07 18:28:20 +09:00
9e48d7f562
hst/config: move container fields from toplevel
...
This change also moves pd behaviour to cmd/hakurei, as this does not belong in the hst API.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-07 04:24:45 +09:00
f280994957
internal/app: check nscd socket for path hiding
...
This can seriously break things, and exposes extra host attack surface, so include it here.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-05 20:47:30 +09:00
eb5ee4fece
internal/app: modularise outcome finalise
...
This is the initial effort of splitting up host and container side of finalisation for params to shim. The new layout also enables much finer grained unit testing of each step, as well as partition access to per-app state for each step.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-05 02:52:50 +09:00
