Commit Graph

54 Commits

Author SHA1 Message Date
cat c661a3b63a cmd/mbf: migrate shell to enter
This reduces duplicate code. This change also adds resolv.conf to the container.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-06-10 13:34:44 +09:00
cat 9e824452bd internal/pkg: expose snapshot of binfmt entries
This is otherwise not externally accessible. The resulting map can be safely mutated.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-06-02 16:05:09 +09:00
cat 688d43417b internal/pkg: rename measured exec type
This type is no longer exclusive to KindExecNet.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-05-12 15:23:33 +09:00
cat 6643cfbeee internal/pkg: optionally measure exec artifact
Useful for verifying deterministic output without enabling network access.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-05-12 15:11:17 +09:00
cat 8d72b9e5bd internal/pkg: optionally register binfmt
This transparently supports curing foreign exec artifacts.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-05-07 19:43:06 +09:00
cat 917be2de93 internal/pkg/exec: close early failure before wait
This avoids a deadlock on an early container failure.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-05-06 18:38:16 +09:00
cat 5a26895a22 internal/pkg: optionally suppress init verbosity
This flag applies to every exec artifact cured by the cache. It has no effect on cure outcome.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-05-05 20:03:06 +09:00
cat 3352bb975b internal/pkg: job count in container environment
This exposes preferred job count to the container initial process.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-04-15 15:49:21 +09:00
cat 10f8b1c221 internal/pkg: optional landlock LSM
The alpine linux riscv64 kernel does not enable Landlock LSM, and kernel compilation is not yet feasible.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-04-07 12:44:07 +09:00
cat 591a60bac9 internal/pkg: per-cache SCHED_IDLE
This is cleaner than setting it globally, and is impossible to race.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-04-03 16:49:34 +09:00
cat 59b25d45fe internal/pkg: pick up $TERM if attaching stdin
This improves behaviour of some programs.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-04-02 23:50:07 +09:00
cat a6600be34a all: use filepath
This makes package check portable, and removes nonportable behaviour from package pkg, pipewire, and system. All other packages remain nonportable due to their nature. No latency increase was observed due to this change on amd64 and arm64 linux.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-30 18:24:53 +09:00
cat e661260607 internal/pkg: enter exec container
This enables much easier troubleshooting of failing cures.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-26 15:05:04 +09:00
cat d2f30173cd internal/pkg: isolate container params
This enables exporting container params for interactive troubleshooting within the cure container.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-26 14:02:58 +09:00
cat 722989c682 fhs: move from container
This package is not container-specific.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-17 15:56:36 +09:00
cat 6d015a949e check: move from container
This package is not container specific, and widely used across the project.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-17 15:39:03 +09:00
cat cd5959fe5a ext: isolate from container/std
These are too general to belong in the container package. This targets the v0.4 release to reduce the wrapper maintenance burden.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-17 13:39:26 +09:00
cat 196b200d0f container: expose priority and SCHED_OTHER policy
The more explicit API removes the arbitrary limit preventing use of SCHED_OTHER (referred to as SCHED_NORMAL in the kernel). This change also exposes priority value to set.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-12 01:14:03 +09:00
cat fd515badff container: move scheduler policy constants to std
This avoids depending on cgo.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-11 20:03:08 +09:00
cat 19a2737148 container: sched policy string representation
This also uses priority obtained via sched_get_priority_min, and improves bounds checking.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-09 18:38:31 +09:00
cat 1e0d68a29e internal/pkg: move output buffer to reader
This side is the read end of a pipe and buffering reads from it ended up performing better than buffering one half of the TeeReader (which already goes through the kernel page cache anyway).

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-06 23:39:12 +09:00
cat 883d4ee4af internal/pkg: return writer after sync
This fixes a use-after-free.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-05 00:23:24 +09:00
cat 94e3debc63 internal/pkg: write per-artifact logs
This is currently only used by execArtifact. A later patch will add additional logging facilities.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-04 17:27:54 +09:00
cat ea87664a75 internal/pkg: cancel on scanner error
This avoids discarding output thus appearing unresponsive.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-03 22:20:43 +09:00
cat c16725a679 internal/pkg: set container scheduling policy
This is not as necessary as it was for nix, since internal/pkg only unblocks exclusive artifacts one at a time. Still, this is useful when running alongside an unprivileged music player which cannot set itself to a higher priority.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-02-26 16:35:23 +09:00
cat 1619b06541 internal/pkg: export layer promotion
This is a useful helper for external tooling.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-02-19 15:06:10 +09:00
cat e335d99c6b internal/pkg: export seccomp presets
This is useful for external tooling providing an execArtifact-like environment.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-02-19 14:30:31 +09:00
cat 710b164c91 internal/pkg: allow devel syscalls
This is required by the GLib test suite, and possibly others.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-02-16 01:46:28 +09:00
cat e0c720681b internal/pkg: standardise artifact IR
This should hopefully provide good separation between the artifact curing backend implementation and the (still work in progress) language. Making the IR parseable also guarantees uniqueness of the representation.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-02-05 08:24:09 +09:00
cat 41f9aebbb7 internal/pkg: allow multiarch
The armv8l busybox binary release needs this to run correctly.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-27 21:07:18 +09:00
cat eb67e5e0a8 internal/pkg: exclusive artifacts
This alleviates scheduler overhead when curing many artifacts.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-27 01:23:50 +09:00
cat 334578fdde internal/pkg: expose underlying reader
This will be fully implemented in httpArtifact in a future commit.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-25 14:48:25 +09:00
cat acee0b3632 internal/pkg: increase output buffer size
This avoids truncating unreasonably long lines from llvm.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-24 11:45:44 +09:00
cat ba75587132 internal/pkg: allow user namespace creation
No good reason to filter this in the execArtifact container, and the extended filter breaks certain programs.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-21 04:49:25 +09:00
cat d933234784 internal/pkg: make checksum available to cure
This enables deduplication by value as implemented in execArtifact.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-19 21:29:56 +09:00
cat 3499a82785 internal/pkg: cache computed identifiers
This eliminates duplicate identifier computations. The new implementation also significantly reduces allocations while computing identifier for a large dependency tree.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-15 23:30:43 +09:00
cat 5fe166a4a7 internal/pkg: exec prefix verbose output
This proxies program output through msg with a name and fd prefix. This also avoids introducing additional information to the container via process stdout/stderr.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-12 22:15:01 +09:00
cat 29951c5174 internal/pkg: caller-supplied reporting name for exec
This does not have a reasonable way of inferring the underlying name. For zero value it falls back to base of executable pathname.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-12 04:17:47 +09:00
cat 7ccc2fc5ec internal/pkg: exec with specific timeout
This change also updates the documentation of NewExec.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-11 17:46:04 +09:00
cat f712466714 internal/pkg: move dependency flooding to cache
This imposes a hard upper limit to concurrency during dependency satisfaction and moves all dependency-related code out of individual implementations of Artifact. This change also includes ctx and msg as part of Cache.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-09 05:20:34 +09:00
cat f2430b5f5e internal/pkg: use short wait delay
The cure is condemned at the point of cancellation and all of its state is destroyed by the deferred cleanup, so it makes little sense to wait for it much.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-08 18:58:51 +09:00
cat 863e6f5db6 internal/pkg: use correct artifact count
This updates buffer sizes and counters to use correct total artifact count.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-08 08:45:37 +09:00
cat 23df2ab999 internal/pkg: place ephemeral upperdir in tmp
This enables the use of directories made writable this way as scratch space.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-08 08:23:16 +09:00
cat 7bd4d7d0e6 internal/pkg: support explicit overlay mount
This removes all but the /work/ auto overlay behaviour and enables much greater flexibility. This also renames ExecContainerPath to ExecPath so it is easier to type.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-08 07:55:09 +09:00
cat b3c30bcc51 internal/pkg: set container WaitDelay
This prevents a container from blocking forever after context is canceled.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-08 06:23:57 +09:00
cat 4eea136308 internal/pkg: do not connect stdin
This introduces external state when verbose.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-07 23:17:58 +09:00
cat 8e08e8f518 internal/pkg: automatic overlay mount on work
This directly submits the upperdir to cache. It is primarily used in bootstrapping where tools are limited and should not be used unless there is a very good reason to.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-07 03:14:33 +09:00
cat 54da6ce03d internal/pkg: respect mount order for overlay temp
Setting it up after everything else prevents covering files in /tmp.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-07 01:03:49 +09:00
cat 45301559bf internal/pkg: fail on empty output directory
This works around the fact that execArtifact always creates the work directory when setting up the bind mount.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-07 00:04:32 +09:00
cat 0df87ab111 internal/pkg: automatic overlay mount on tmp
This sets up the last Artifact to target /tmp as a writable overlay mount backed by the host side temp directory. This is useful for an Artifact containing source code to be built for another Artifact for example.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-01-06 23:45:08 +09:00