e94acc424c
container/comp: rename from bits
...
This package will also hold syscall lookup tables for seccomp.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-21 20:54:03 +09:00
87b5c30ef6
message: relocate from container
...
This package is quite useful. This change allows it to be imported without importing container.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-09 05:18:19 +09:00
5d18af0007
container/fhs: move pathname constants
...
This allows referencing FHS pathnames without importing container.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-07 21:29:16 +09:00
0e6c1a5026
container/check: move absolute pathname
...
This allows use of absolute pathname values without importing container.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-07 20:57:58 +09:00
3ce63e95d7
container: move seccomp preset bits
...
This allows holding the bits without cgo.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-07 18:28:20 +09:00
46cd3a28c8
container: remove global msg
...
This frees all container instances of side effects.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-09-29 06:11:47 +09:00
3f25c3f0af
container: initialise cmd early
...
This allows use of more cmd methods.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-09-13 20:01:33 +09:00
780e3e5465
container/msg: optionally provide error messages
...
This makes handling of fatal errors a lot less squirmy.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-31 11:57:59 +09:00
712cfc06d7
container: wrap container init start errors
...
This helps indicate the exact origin and nature of the error. This eliminates generic WrapErr from container.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-30 23:44:48 +09:00
5db0714072
container: optionally isolate host abstract UNIX domain sockets via landlock
2025-08-18 16:28:14 +09:00
69a4ab8105
container: move PR_SET_NO_NEW_PRIVS to parent
...
This allows some LSM setup in the parent.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-18 11:46:02 +09:00
0ac6e99818
container: start from locked thread
...
This allows setup that relies on per-thread state like securebits and landlock, from the parent side.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-17 17:42:22 +09:00
e99d7affb0
container: use absolute for pathname
...
This is simultaneously more efficient and less error-prone. This change caused minor API changes in multiple other packages.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-11 04:56:42 +09:00
02271583fb
container: remove PATH lookup behaviour
...
This is way higher level than the container package and does not even work unless every path is mounted in the exact same location.
This behaviour causes nothing but confusion and problems,
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-09 19:08:54 +09:00
edd6f2cfa9
container: document ambient capabilities
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-08 02:11:55 +09:00
f1a53d6116
container: raise CAP_DAC_OVERRIDE
...
This is required for upperdir and workdir checks in overlayfs.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-08 00:43:19 +09:00
c6be82bcf9
container/path: fhs path constants
...
This increases readability since this can help disambiguate absolute paths from similarly named path segments.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-03 21:16:45 +09:00
347a79df72
container: improve clone flags readability
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-02 18:19:44 +09:00
940ee00ffe
container/init: configurable lingering process wait delay
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-07-29 02:38:17 +09:00
d6b07f12ff
container: forward context cancellation
...
This allows container processes to exit gracefully.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-07-28 01:45:38 +09:00
65fe09caf9
container: check cancel signal delivery
...
This change also makes some parts of the test more robust.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-07-28 01:04:29 +09:00
a1e5f020f4
container: improve doc comments
...
Putting them on the builder methods is more useful.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-07-27 12:27:42 +09:00
e71ae3b8c5
container: remove custom cmd initialisation
...
This part of the interface is very unintuitive and only used for testing, even in testing it is inelegant and can be done better.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-07-25 00:45:10 +09:00
9d7a19d162
container: use more reliable nonexistence
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-07-18 23:18:26 +09:00
d2f9a9b83b
treewide: migrate to hakurei.app
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-07-03 03:30:39 +09:00
1b5ecd9eaf
container: move out of toplevel
...
This allows slightly easier use of the vanity url. This also provides some disambiguation between low level containers and hakurei app containers.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-07-03 02:59:43 +09:00
