2494ede106
container/init: configure interface lo
...
This enables loopback networking when owning the net namespace.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-01-11 03:36:20 +09:00
3d720ada92
container: optionally allow orphan
...
This is required for the typical daemonise use case.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-12-27 09:12:02 +09:00
ac34635890
container: set FD_CLOEXEC on all open files
...
While fd created from this side always has the FD_CLOEXEC flag, the same is not true for files left open by the parent. This change prevents those files from leaking into the container.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-11-12 00:18:29 +09:00
fba201c995
container/std: relocate rule types
...
This enables its use in hst for #15 .
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-11-05 06:00:39 +09:00
c1399f5030
std: rename from comp
...
Seccomp lookup tables are going to be relocated here, and PNR constants.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-11-05 02:47:43 +09:00
ae66b3d2fb
message: rename NewMsg to New
...
Should have done this when relocating this from container. Now is a good time to rename it before v0.3.x.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-11-03 01:49:27 +09:00
68ff0a2ba6
container/params: expose pipe
...
This increases flexibility of how caller wants to handle the I/O. Also makes it no longer rely on finalizer.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-31 22:39:02 +09:00
57231d4acf
container/init: improve signal handling
...
The SIGTERM signal is delivered in many other cases and can lead to strange behaviour. The unconditional resume of the logger also causes strange behaviour in the cancellation forwarding path. This change also passes through additional signals.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-23 08:02:03 +09:00
e94acc424c
container/comp: rename from bits
...
This package will also hold syscall lookup tables for seccomp.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-21 20:54:03 +09:00
87b5c30ef6
message: relocate from container
...
This package is quite useful. This change allows it to be imported without importing container.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-09 05:18:19 +09:00
5d18af0007
container/fhs: move pathname constants
...
This allows referencing FHS pathnames without importing container.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-07 21:29:16 +09:00
0e6c1a5026
container/check: move absolute pathname
...
This allows use of absolute pathname values without importing container.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-07 20:57:58 +09:00
3ce63e95d7
container: move seccomp preset bits
...
This allows holding the bits without cgo.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-07 18:28:20 +09:00
46cd3a28c8
container: remove global msg
...
This frees all container instances of side effects.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-09-29 06:11:47 +09:00
3f25c3f0af
container: initialise cmd early
...
This allows use of more cmd methods.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-09-13 20:01:33 +09:00
780e3e5465
container/msg: optionally provide error messages
...
This makes handling of fatal errors a lot less squirmy.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-31 11:57:59 +09:00
712cfc06d7
container: wrap container init start errors
...
This helps indicate the exact origin and nature of the error. This eliminates generic WrapErr from container.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-30 23:44:48 +09:00
5db0714072
container: optionally isolate host abstract UNIX domain sockets via landlock
2025-08-18 16:28:14 +09:00
69a4ab8105
container: move PR_SET_NO_NEW_PRIVS to parent
...
This allows some LSM setup in the parent.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-18 11:46:02 +09:00
0ac6e99818
container: start from locked thread
...
This allows setup that relies on per-thread state like securebits and landlock, from the parent side.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-17 17:42:22 +09:00
e99d7affb0
container: use absolute for pathname
...
This is simultaneously more efficient and less error-prone. This change caused minor API changes in multiple other packages.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-11 04:56:42 +09:00
02271583fb
container: remove PATH lookup behaviour
...
This is way higher level than the container package and does not even work unless every path is mounted in the exact same location.
This behaviour causes nothing but confusion and problems,
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-09 19:08:54 +09:00
edd6f2cfa9
container: document ambient capabilities
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-08 02:11:55 +09:00
f1a53d6116
container: raise CAP_DAC_OVERRIDE
...
This is required for upperdir and workdir checks in overlayfs.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-08 00:43:19 +09:00
c6be82bcf9
container/path: fhs path constants
...
This increases readability since this can help disambiguate absolute paths from similarly named path segments.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-03 21:16:45 +09:00
347a79df72
container: improve clone flags readability
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-02 18:19:44 +09:00
940ee00ffe
container/init: configurable lingering process wait delay
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-07-29 02:38:17 +09:00
d6b07f12ff
container: forward context cancellation
...
This allows container processes to exit gracefully.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-07-28 01:45:38 +09:00
65fe09caf9
container: check cancel signal delivery
...
This change also makes some parts of the test more robust.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-07-28 01:04:29 +09:00
a1e5f020f4
container: improve doc comments
...
Putting them on the builder methods is more useful.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-07-27 12:27:42 +09:00
e71ae3b8c5
container: remove custom cmd initialisation
...
This part of the interface is very unintuitive and only used for testing, even in testing it is inelegant and can be done better.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-07-25 00:45:10 +09:00
9d7a19d162
container: use more reliable nonexistence
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-07-18 23:18:26 +09:00
d2f9a9b83b
treewide: migrate to hakurei.app
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-07-03 03:30:39 +09:00
1b5ecd9eaf
container: move out of toplevel
...
This allows slightly easier use of the vanity url. This also provides some disambiguation between low level containers and hakurei app containers.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-07-03 02:59:43 +09:00
