ea978101b1
cmd/hakurei/parse: close config fd
...
This is cleaner than relying on the finalizer.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-21 06:05:36 +09:00
d42067df7c
cmd/hakurei/json: friendly error messages
...
This change handles errors returned by encoding/json and prints significantly cleaner messages.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-21 05:17:25 +09:00
5063b774c1
hst: expose version string
...
The hst API is tied to this version string.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-21 01:56:44 +09:00
766dd89ffa
internal: clean up build strings
...
These names are less ambiguous and should be understandable without reading the source code.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-21 01:49:36 +09:00
699c19e972
hst/container: optional runtime and tmpdir sharing
...
Sharing and persisting these directories do not always make sense. Make it optional here.
Closes #16 .
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-19 04:11:38 +09:00
f6f0cb56ae
internal/app/hsu: remove wrapper method
...
This was added to reduce the size of diffs.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-18 17:35:20 +09:00
f95e0a7568
hst/config: hold acl struct by value
...
Doc comments are also reworded for clarity.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-14 07:02:14 +09:00
4c647add0d
hst/container: pack boolean options
...
The memory saving is relatively insignificant, however this increases serialisation efficiency.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-14 06:39:00 +09:00
7638a44fa6
treewide: parallel tests
...
Most tests already had no global state, however parallel was never enabled. This change enables it for all applicable tests.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-13 04:38:48 +09:00
f5a597c406
hst: rename /.hakurei constant
...
This provides disambiguation from fhs.AbsTmp.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-11 14:32:35 +09:00
8874aaf81b
hst: remove template bind nix store
...
This does not add anything meaningful to the template, since there are already prior examples showing src-only bind ops. Remove this since it causes confusion by covering the previous mount point targeting /nix/store.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-11 13:59:10 +09:00
04a27c8e47
hst: use plausible overlay template
...
The current value is copied from a test case, and does not resemble its intended use case.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-11 13:51:08 +09:00
87b5c30ef6
message: relocate from container
...
This package is quite useful. This change allows it to be imported without importing container.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-09 05:18:19 +09:00
5bf28901a4
cmd/hsu: check against setgid bit
...
The getgroups behaviour is already checked for, but it never hurts to be more careful in a setuid program.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-08 18:22:24 +09:00
5d18af0007
container/fhs: move pathname constants
...
This allows referencing FHS pathnames without importing container.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-07 21:29:16 +09:00
0e6c1a5026
container/check: move absolute pathname
...
This allows use of absolute pathname values without importing container.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-07 20:57:58 +09:00
d23b4dc9e6
hst/dbus: move dbus config struct
...
This allows holding a xdg-dbus-proxy configuration without importing system/dbus.
It also makes more sense in the project structure since the config struct is part of the hst API however the rest of the implementation is not.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-07 19:03:51 +09:00
9e48d7f562
hst/config: move container fields from toplevel
...
This change also moves pd behaviour to cmd/hakurei, as this does not belong in the hst API.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-07 04:24:45 +09:00
ae7b343cde
hst: reword and move constants
...
These values are considered part of the stable, exported API, so move them to hst.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-05 17:40:32 +09:00
a5f0aa3f30
internal/app: declutter and merge small files
...
This should make internal/app easier to work with for the upcoming params to shim.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-10-03 16:59:29 +09:00
e58181a930
internal/app/paths: defer extra formatting
...
This reduces payload size for params to shim.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-09-30 00:21:26 +09:00
71e70b7b5f
internal/app/paths: do not print messages
...
This change was missed while merging the rest of the logging changes.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-09-29 09:30:57 +09:00
1ba1cb8865
hst/config: remove seccomp bit fields
...
These serve little purpose and are not friendly for use from other languages.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-09-29 07:07:16 +09:00
44ba7a5f02
hst/enablement: move bits from system
...
This is part of the hst API, should not be in the implementation package.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-09-29 06:34:29 +09:00
46cd3a28c8
container: remove global msg
...
This frees all container instances of side effects.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-09-29 06:11:47 +09:00
ae2df2c450
internal: remove sys package
...
This package is replaced by container/stub. Remove and replace it with unexported implementation for the upcoming test suite rewrite.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-09-25 13:51:54 +09:00
afa7a0800d
cmd/hsu: return hsurc id
...
The uid format is stable, this value is what caller has to obtain through hsu.
Closes #14 .
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-09-24 21:10:13 +09:00
1c4f593566
internal/app: unexport outcome, remove app struct
...
The App struct no longer does anything, and the outcome struct is entirely opaque.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-09-24 18:44:14 +09:00
b99c63337d
internal/app: do not return from shim start
...
The whole RunState ugliness and the other horrendous error handling conditions for internal/app come from an old design proposal for maintaining all app containers under the same daemon process for a user. The proposal was ultimately rejected but the implementation remained. It is removed here to alleviate internal/app from much of its ugliness and unreadability.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-09-24 13:37:38 +09:00
a2a291791c
internal/sys: separate hsu uid cache
...
This begins the effort of the removal of the sys package.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-09-15 02:30:47 +09:00
f876043844
internal/hlog: remove error wrapping
...
This was a stopgap solution that lasted for way too long. This finally removes it and prepares internal/app for some major changes.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-09-12 06:52:35 +09:00
92f510a647
cmd/hakurei/command: pd run dbus-verbose nil check
...
This otherwise dereferences a nil pointer when dbus-verbose is set and either session or system bus are nil.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-09-06 00:09:25 +09:00
4cf694d2b3
hst: use hsu userid for share path suffix
...
The privileged user is identifier to hakurei through its hsu userid. Using the kernel uid here makes little sense and is a leftover design choice from before hsu was implemented.
Closes #7 .
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-26 02:16:33 +09:00
c9facb746b
hst/config: remove data field, rename dir to home
...
There is no reason to give the home directory special treatment, as this behaviour can be quite confusing. The home directory also does not necessarily require its own mount point, it could be provided by a parent or simply be ephemeral.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-26 00:56:10 +09:00
878b66022e
hst/fsbind: optional ensure source
...
This exposes the BindEnsure flag of BindMountOp.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-26 00:50:23 +09:00
c328b584c0
hst/fslink: improve string representation
...
This shortens the representation of most common use cases and generally improves readability.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-25 22:52:48 +09:00
9585b35d5b
hst/config: remove symlink field
...
Closes #6 .
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-25 22:23:54 +09:00
0dcac55a0c
hst/config: remove container etc field
...
This no longer needs special treatment since it can be specified as a generic filesystem entry.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-25 19:24:33 +09:00
6d202d73b4
hst/fsbind: optional autoetc behaviour
...
This generalises the special field allowing any special behaviour to be matched from target.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-25 18:38:19 +09:00
1438096339
hst/config: handle filesystem entry targeting root
...
This allows any fstype supported by hst to be directly mounted on sysroot. A special case in internal/app applies the matching entry early and excludes it from path hiding.
Closes #5 .
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-25 17:52:57 +09:00
13c7083bc0
container: ptrace protection via Yama LSM
...
This is only a nice to have feature as the init process has no additional privileges and the monitor process was never reachable anyway.
Closes #4 .
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-20 00:43:55 +09:00
3c9e547c4a
cmd/hpkg: add deprecation notice
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-18 17:00:27 +09:00
a3988c1a77
hst: rename net and abstract fields
...
This makes more sense and matches the container library.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-18 16:48:01 +09:00
5db0714072
container: optionally isolate host abstract UNIX domain sockets via landlock
2025-08-18 16:28:14 +09:00
8dd3e1ee5d
hst/fs: rename method Target to Path
...
This allows adapter structs to use the same field names as Op structs.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-16 02:06:41 +09:00
4ffeec3004
hst/enablement: editor friendly enablement adaptor
...
Having the bit field value here (in decimal, no less) is unfriendly to text editors. Use a bunch of booleans here to improve ease of use.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-15 05:16:51 +09:00
9ed3ba85ea
hst/fs: implement overlay fstype
...
This finally exposes overlay mounts in the high level hakurei API.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-15 04:00:55 +09:00
c989e7785a
hst/info: include extra information
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-14 19:52:03 +09:00
99ac96511b
hst/fs: interface filesystem config
...
This allows mount points to be represented by different underlying structs.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-14 04:52:49 +09:00
e99d7affb0
container: use absolute for pathname
...
This is simultaneously more efficient and less error-prone. This change caused minor API changes in multiple other packages.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-11 04:56:42 +09:00
