maemachinebroke/hakurei
1
0
Fork 0
forked from rosa/hakurei
Code Pull Requests Activity
844 Commits 7 Branches 12 Tags
edd6f2cfa9b08c5c43cea545f9ecc8b5021cf9d6
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
cat edd6f2cfa9 container: document ambient capabilities 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-08 02:11:55 +09:00
cat acffa76812 container/ops: implement overlay op 
There are significant limitations to using the overlay mount, and the implementation in the kernel is quite quirky. For now the Op is quite robust, however a higher level interface for it has not been decided yet.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-08 01:54:48 +09:00
cat 8da76483e6 container/path: fix typo "paths" 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-08 01:32:48 +09:00
cat 534c932906 container: test case runtime initialisation 
This allows for more sophisticated test setup.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-08 01:03:35 +09:00
cat fee10fed4d container: test bypass output buffer on verbose 
This restores verbose behaviour.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-08 00:57:27 +09:00
cat a4f7e92e1c test/interactive: helper scripts for tracing 
The vm state is discarded often, and it is quite cumbersome to set everything up again when the shell history is gone.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-08 00:56:25 +09:00
cat f1a53d6116 container: raise CAP_DAC_OVERRIDE 
This is required for upperdir and workdir checks in overlayfs.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-08 00:43:19 +09:00
cat b353c3deea nix: make src overlay writable 
The lowerdir is in the nix store.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-07 18:07:19 +09:00
cat fde5f1ca64 container: buffer test output 
This further reduces noise on test failure by only passing through output of the failed test.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-07 02:55:58 +09:00
cat 4d0bdd84b5 container: test respect verbose flag 
This reduces noise on test failure.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-07 02:50:00 +09:00
cat 72a931a71a nix: interactive nixos vm 
This is useful for quickly spinning up an ephemeral hakurei environment for testing changes or reproducing vm test failures.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-07 02:46:04 +09:00
cat 9a25542c6d container/init: use mount string constants 
These literals were missed when the constants were first defined.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-04 04:00:05 +09:00
cat c6be82bcf9 container/path: fhs path constants 
This increases readability since this can help disambiguate absolute paths from similarly named path segments.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-03 21:16:45 +09:00
cat 38245559dc container/ops: mount dev readonly 
There is usually no good reason to write to /dev. This however doesn't work in internal/app because FilesystemConfig supplied by ContainerConfig might add entries to /dev, so internal/app follows DevWritable with Remount instead.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-03 19:18:53 +09:00
cat 7b416d47dc container/ops: merge mqueue and dev Ops 
There is no reason to mount mqueue anywhere else, and these Ops usually follow each other. This change merges them. This helps decrease IPC overhead and also enables mounting dev readonly.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-03 19:13:46 +09:00
cat 15170735ba container/mount: move tmpfs sysroot prefixing to caller 
The mountTmpfs helper is a relatively low level function that is not exposed as part of the API. Prefixing sysroot here not only introduces overhead but is also quite error-prone.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-03 18:06:41 +09:00
cat 6a3886e9db container/op: unexport bind resolved source field 
This is used for symlink resolution and is only used internally.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-03 17:57:37 +09:00
cat ff66296378 container/mount: mount data escape helper function 
For formatting user-supplied path strings into overlayfs mount data.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-03 17:46:14 +09:00
cat 347a79df72 container: improve clone flags readability 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-02 18:19:44 +09:00
cat 0f78864a67 container/mount: export mount string constants 
This improves code readability and should also be useful for callers choosing to preserve CAP_SYS_ADMIN.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-02 17:20:09 +09:00
cat b32b1975a8 hst/container: remove cover 
This was never useful, and is now completely replaced by regular FilesystemConfig being able to mount tmpfs.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-02 00:34:52 +09:00
cat 2b1eaa62f1 update github notice 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-02 00:21:16 +09:00
cat f13dca184c release: 0.1.3 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-02 00:02:54 +09:00
cat 3b8a3d3b00 app: remount root readonly 
This does nothing for security, but should help avoid hiding bugs of programs developed in a hakurei container.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-01 23:56:28 +09:00
cat c5d24979f5 container/ops: expose remount as Op 
This is useful for building a filesystem hierarchy then remounting it readonly.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-01 23:48:02 +09:00
cat 1dc780bca7 container/mount: separate remount from bind 
Remount turns out to be useful in other places.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-01 23:32:38 +09:00
cat ec33061c92 nix: remove nscd cover 
This is a pd workaround that does nothing in the nixos module.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-01 22:04:58 +09:00
cat af0899de96 hst/container: mount tmpfs via magic src string 
There's often good reason to mount tmpfs in the container.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-01 21:23:52 +09:00
cat 547a2adaa4 container/mount: pass tmpfs flags 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-01 18:59:06 +09:00
cat c02948e155 cmd/hakurei: print autoroot configuration 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-01 04:29:01 +09:00
cat 387b86bcdd app: integrate container autoroot 
Doing this instead of mounting directly on / because it's impossible to ensure a parent is available for every path hakurei wants to mount to. This situation is similar to autoetc hence the similar name, however a symlink mirror will not work in this case.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-01 04:21:54 +09:00
cat 4e85643865 container: implement autoroot as setup op 
This code is useful beyond just pd behaviour, and implementing it this way also reduces IPC overhead.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-01 04:04:36 +09:00
cat 987981df73 test/sandbox: check pd behaviour 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-01 03:27:02 +09:00
cat f14e7255be container/ops: use correct flags value in bind string 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-01 00:54:08 +09:00
cat a8a79a8664 cmd/hpkg: rename from planterette 
Planterette is now developed in another repository, so rename this proof of concept to avoid confusion.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-31 23:57:11 +09:00
cat 3ae0cec000 test: increase vm memory 
This hopefully fixes the intermittent failures.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-31 22:08:01 +09:00
cat 4e518f11d8 container/ops: autoetc implementation to separate file 
This is not a general purpose setup Op. Separate it so it is easier to find.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-31 19:54:03 +09:00
cat cb513bb1cd release: 0.1.2 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-29 03:11:33 +09:00
cat f7bd28118c hst: configurable wait delay 
This is useful for programs that take a long time to clean up.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-29 03:06:49 +09:00
cat 940ee00ffe container/init: configurable lingering process wait delay 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-29 02:38:17 +09:00
cat b43d104680 app: integrate interrupt forwarding 
This significantly increases usability of command line tools running through hakurei.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-29 02:23:06 +09:00
cat ddf48a6c22 app/shim: implement signal handler outcome in Go 
This needs to be done from the Go side eventually anyway to integrate the signal forwarding behaviour now supported by the container package.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-28 23:39:30 +09:00
cat a0f499e30a app/shim: separate signal handler implementation 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-28 21:52:53 +09:00
cat d6b07f12ff container: forward context cancellation 
This allows container processes to exit gracefully.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-28 01:45:38 +09:00
cat 65fe09caf9 container: check cancel signal delivery 
This change also makes some parts of the test more robust.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-28 01:04:29 +09:00
cat a1e5f020f4 container: improve doc comments 
Putting them on the builder methods is more useful.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-27 12:27:42 +09:00
cat bd3fa53a55 container: access test case by index in helper 
This is more elegant and allows for much easier extension of the tests. Mountinfo is still serialised however due to libPaths nondeterminism.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-26 18:59:19 +09:00
cat 625632c593 nix: update flake lock 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-26 18:57:54 +09:00
cat e71ae3b8c5 container: remove custom cmd initialisation 
This part of the interface is very unintuitive and only used for testing, even in testing it is inelegant and can be done better.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-25 00:45:10 +09:00
cat 9d7a19d162 container: use more reliable nonexistence 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-18 23:18:26 +09:00
cat 6ba19a7ba5 release: 0.1.1 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-09 05:42:31 +09:00
cat 749a2779f5 test/sandbox: add arm64 constants 
Most of these are differences in qemu.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-09 05:36:35 +09:00
cat e574042d76 test/sandbox: verify seccomp on all test cases 
This change also makes seccomp hashes cross-platform.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-09 04:21:35 +09:00
cat 2b44493e8a test/sandbox: guard on testtool tag 
This tool should not show up when building hakurei normally.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-07 20:11:29 +09:00
cat c30dd4e630 test/sandbox/seccomp: remove uselib 
This syscall is not wired on all platforms. This test barely does anything anyway and seccomp is covered by the privileged test instrumentation.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-07 15:28:55 +09:00
cat d90da1c8f5 container/seccomp: add arm64 constants 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-07 14:58:03 +09:00
cat 5853d7700f container/seccomp: move bpf hashes 
Filter programs are different across platforms. This representation is also much more readable.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-07 14:41:47 +09:00
cat d5c7523726 container/init: fix prctl call 
This is a very silly typo. Luckily has no effect due to an upper layer doing PR_SET_NO_NEW_PRIVS already.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-07 14:06:14 +09:00
cat ddfcc51b91 container: move capset implementation 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-07 13:47:13 +09:00
cat 8ebedbd88a container: move syscall constants 
These aren't missing from all targets.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-07 13:23:01 +09:00
cat 84e8142a2d container/seccomp: move personality constants 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-07 12:44:32 +09:00
cat 2c7b7ad845 container/seccomp: cross-platform sysnum cutoff 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-07 12:27:00 +09:00
cat 72c2b66fc0 nix: cross-platform syscall wrapper 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-07 04:22:55 +09:00
cat 356b42a406 container/init: use /proc/self as intermediate 
Setting up via /tmp is okay, /proc/self/fd makes a lot more sense though for reasons described in the comment.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-06 02:14:35 +09:00
cat d9b6d48e7c add miscellaneous badges 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-03 18:04:09 +09:00
cat 087959e81b app: remove split implementation 
It is completely nonsensical and highly error-prone to have multiple implementations of this in the same build. This should be switched at compile time instead therefore the split packages are pointless.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-03 04:36:59 +09:00
cat e6967b8bbb release: 0.1.0 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-03 03:42:58 +09:00
cat d2f9a9b83b treewide: migrate to hakurei.app 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-03 03:30:39 +09:00
cat 1b5ecd9eaf container: move out of toplevel 
This allows slightly easier use of the vanity url. This also provides some disambiguation between low level containers and hakurei app containers.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-03 02:59:43 +09:00
cat 82561d62b6 system: move system access packages 
These packages loosely belong in the "system" package and "system" provides high level wrappers for all of them.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 21:52:07 +09:00
cat eec021cc4b hakurei: move container helpers toplevel 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 21:31:29 +09:00
cat a1d98823f8 hakurei: move container toplevel 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 21:23:55 +09:00
cat 255b77d91d cmd/hakurei: move command handlers 
The hakurei command is a bit ugly since it's also used for validating the command package. This alleviates some of the ugliness.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 20:59:17 +09:00
cat f84ec5a3f8 sandbox/wl: track generated files 
This allows the package to be imported.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 20:52:22 +09:00
cat eb22a8bcc1 cmd/hakurei: move to cmd 
Having it at the project root never made sense since the "ego" name was deprecated. This change finally addresses it.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 20:42:51 +09:00
cat 31aef905fa sandbox: expose seccomp interface 
There's no point in artificially limiting and abstracting away these options. The higher level hakurei package is responsible for providing a secure baseline and sane defaults. The sandbox package should present everything to the caller.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 04:47:13 +09:00
cat a6887f7253 sandbox/seccomp: import dot for syscall 
This significantly increases readability in some places.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 02:30:35 +09:00
cat 69bd581af7 sandbox/seccomp: append suffix to ops 
This avoids clashes with stdlib names to allow for . imports.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 01:09:04 +09:00
cat 26b7afc890 sandbox/seccomp: prepare -> export 
Export makes a lot more sense, and also matches the libseccomp function.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 00:32:48 +09:00
cat d5532aade0 sandbox/seccomp: native rule slice in helpers 
These helper functions took FilterPreset as input for ease of integration. This moves them to []NativeRule.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 00:22:27 +09:00
cat 0c5409aec7 sandbox/seccomp: native rule type alias 
This makes it easier to keep API stable.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 00:00:08 +09:00
cat 1a8840bebc sandbox/seccomp: resolve rules natively 
This enables loading syscall filter policies from external cross-platform config files.

This also removes a significant amount of C code.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-01 22:11:32 +09:00
cat 1fb453dffe sandbox/seccomp: extra constants 
These all resolve to pseudo syscall numbers in libseccomp, but are necessary anyway for other platforms.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-01 20:15:42 +09:00
cat e03d702d08 sandbox/seccomp: implement syscall lookup 
This uses the Go map and is verified against libseccomp.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-01 00:35:27 +09:00
cat 241dc964a6 sandbox/seccomp: wire extra syscall 
These values are only useful for libseccomp.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-01 00:32:08 +09:00
cat 8ef71e14d5 sandbox/seccomp: emit syscall constants 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-30 20:34:33 +09:00
cat 972f4006f0 treewide: switch to hakurei.app 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-26 04:01:02 +09:00
cat 9a8a047908 sandbox/seccomp: syscall name lookup table 
The script is from Go source of same name. The result is checked against libseccomp.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-26 03:49:07 +09:00
cat 863bf69ad3 treewide: reapply clang-format 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-25 23:43:42 +09:00
cat 0e957cc9c1 release: 0.0.2 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-25 21:11:11 +09:00
cat aa454b158f cmd/planterette: remove hsu special case 
Remove special case and invoke hakurei out of process.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-25 20:50:24 +09:00
cat 7007bd6a1c workflows: port release workflow to github 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-25 20:17:53 +09:00
cat 00efc95ee7 workflows: port test workflow to github 
This is a much less useful port of the test workflow and runs much slower due to runner limitations.

Still better than nothing though.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-25 19:37:45 +09:00
cat b380bb248c release: 0.0.1 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-25 05:05:06 +09:00
cat 87e008d56d treewide: rename to hakurei 
Fortify makes little sense for a container tool.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-25 04:57:41 +09:00
cat 3992073212 dist: move comp to dist 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-18 17:01:16 +09:00
cat ef80b19f2f treewide: switch to clang-format 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-18 13:45:34 +09:00
cat 717771ae80 app: share runtime dir 
This allows apps with the same identity to access the same runtime dir.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-08 03:24:48 +09:00
cat bf5772bd8a nix: deduplicate home-manager merging 
This becomes a problem when extraHomeConfig defines nixos module options.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-08 01:12:18 +09:00
cat 9a7c81a44e nix: go generate in src derivation 
This saves the generated files in the nix store and exposes them for use by external tools.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-07 03:10:36 +09:00