27 Commits

Author	SHA1	Message	Date
Ophestra	57231d4acf	container/init: improve signal handling ... The SIGTERM signal is delivered in many other cases and can lead to strange behaviour. The unconditional resume of the logger also causes strange behaviour in the cancellation forwarding path. This change also passes through additional signals. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-10-23 08:02:03 +09:00
Ophestra	e94acc424c	container/comp: rename from bits ... This package will also hold syscall lookup tables for seccomp. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-10-21 20:54:03 +09:00
Ophestra	87b5c30ef6	message: relocate from container ... This package is quite useful. This change allows it to be imported without importing container. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-10-09 05:18:19 +09:00
Ophestra	5d18af0007	container/fhs: move pathname constants ... This allows referencing FHS pathnames without importing container. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-10-07 21:29:16 +09:00
Ophestra	0e6c1a5026	container/check: move absolute pathname ... This allows use of absolute pathname values without importing container. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-10-07 20:57:58 +09:00
Ophestra	3ce63e95d7	container: move seccomp preset bits ... This allows holding the bits without cgo. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-10-07 18:28:20 +09:00
Ophestra	46cd3a28c8	container: remove global msg ... This frees all container instances of side effects. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-29 06:11:47 +09:00
Ophestra	3f25c3f0af	container: initialise cmd early ... This allows use of more cmd methods. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-13 20:01:33 +09:00
Ophestra	780e3e5465	container/msg: optionally provide error messages ... This makes handling of fatal errors a lot less squirmy. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-31 11:57:59 +09:00
Ophestra	712cfc06d7	container: wrap container init start errors ... This helps indicate the exact origin and nature of the error. This eliminates generic WrapErr from container. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-30 23:44:48 +09:00
Clayton Gilmer	5db0714072	container: optionally isolate host abstract UNIX domain sockets via landlock	2025-08-18 16:28:14 +09:00
Ophestra	69a4ab8105	container: move PR_SET_NO_NEW_PRIVS to parent ... This allows some LSM setup in the parent. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-18 11:46:02 +09:00
Ophestra	0ac6e99818	container: start from locked thread ... This allows setup that relies on per-thread state like securebits and landlock, from the parent side. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-17 17:42:22 +09:00
Ophestra	e99d7affb0	container: use absolute for pathname ... This is simultaneously more efficient and less error-prone. This change caused minor API changes in multiple other packages. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-11 04:56:42 +09:00
Ophestra	02271583fb	container: remove PATH lookup behaviour ... This is way higher level than the container package and does not even work unless every path is mounted in the exact same location. This behaviour causes nothing but confusion and problems, Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-09 19:08:54 +09:00
Ophestra	edd6f2cfa9	container: document ambient capabilities ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-08 02:11:55 +09:00
Ophestra	f1a53d6116	container: raise CAP_DAC_OVERRIDE ... This is required for upperdir and workdir checks in overlayfs. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-08 00:43:19 +09:00
Ophestra	c6be82bcf9	container/path: fhs path constants ... This increases readability since this can help disambiguate absolute paths from similarly named path segments. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-03 21:16:45 +09:00
Ophestra	347a79df72	container: improve clone flags readability ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-02 18:19:44 +09:00
Ophestra	940ee00ffe	container/init: configurable lingering process wait delay ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-29 02:38:17 +09:00
Ophestra	d6b07f12ff	container: forward context cancellation ... This allows container processes to exit gracefully. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-28 01:45:38 +09:00
Ophestra	65fe09caf9	container: check cancel signal delivery ... This change also makes some parts of the test more robust. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-28 01:04:29 +09:00
Ophestra	a1e5f020f4	container: improve doc comments ... Putting them on the builder methods is more useful. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-27 12:27:42 +09:00
Ophestra	e71ae3b8c5	container: remove custom cmd initialisation ... This part of the interface is very unintuitive and only used for testing, even in testing it is inelegant and can be done better. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-25 00:45:10 +09:00
Ophestra	9d7a19d162	container: use more reliable nonexistence ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-18 23:18:26 +09:00
Ophestra	d2f9a9b83b	treewide: migrate to hakurei.app ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-03 03:30:39 +09:00
Ophestra	1b5ecd9eaf	container: move out of toplevel ... This allows slightly easier use of the vanity url. This also provides some disambiguation between low level containers and hakurei app containers. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-03 02:59:43 +09:00