Ophestra
a341466942
All checks were successful
Test / Create distribution (push) Successful in 34s
Test / Sandbox (push) Successful in 2m11s
Test / Hakurei (push) Successful in 3m7s
Test / Sandbox (race detector) (push) Successful in 4m7s
Test / Hpkg (push) Successful in 4m9s
Test / Hakurei (race detector) (push) Successful in 4m47s
Test / Flake checks (push) Successful in 1m31s
The booleans are getting packed into a single field. This requires non-insignificant amount of code for JSON serialisation to stay compatible. Signed-off-by: Ophestra <cat@gensokyo.uk>
87 lines
3.2 KiB
Go
87 lines
3.2 KiB
Go
package hst
|
|
|
|
import (
|
|
"time"
|
|
|
|
"hakurei.app/container/check"
|
|
)
|
|
|
|
// PrivateTmp is a private writable path in a hakurei container.
|
|
const PrivateTmp = "/.hakurei"
|
|
|
|
// AbsPrivateTmp is a [check.Absolute] representation of [PrivateTmp].
|
|
var AbsPrivateTmp = check.MustAbs(PrivateTmp)
|
|
|
|
const (
|
|
// WaitDelayDefault is used when WaitDelay has its zero value.
|
|
WaitDelayDefault = 5 * time.Second
|
|
// WaitDelayMax is used if WaitDelay exceeds its value.
|
|
WaitDelayMax = 30 * time.Second
|
|
|
|
// IdentityMin is the minimum value of [Config.Identity]. This is enforced by cmd/hsu.
|
|
IdentityMin = 0
|
|
// IdentityMax is the maximum value of [Config.Identity]. This is enforced by cmd/hsu.
|
|
IdentityMax = 9999
|
|
|
|
// ShimExitRequest is returned when the priv side process requests shim exit.
|
|
ShimExitRequest = 254
|
|
// ShimExitOrphan is returned when the shim is orphaned before priv side delivers a signal.
|
|
ShimExitOrphan = 3
|
|
)
|
|
|
|
// ContainerConfig describes the container configuration to be applied to an underlying [container].
|
|
type ContainerConfig struct {
|
|
// Container UTS namespace hostname.
|
|
Hostname string `json:"hostname,omitempty"`
|
|
|
|
// Duration in nanoseconds to wait for after interrupting the initial process.
|
|
// Defaults to [WaitDelayDefault] if zero, or [WaitDelayMax] if greater than [WaitDelayMax].
|
|
// Values lesser than zero is equivalent to zero, bypassing [WaitDelayDefault].
|
|
WaitDelay time.Duration `json:"wait_delay,omitempty"`
|
|
|
|
// Emit Flatpak-compatible seccomp filter programs.
|
|
SeccompCompat bool `json:"seccomp_compat,omitempty"`
|
|
// Allow ptrace and friends.
|
|
Devel bool `json:"devel,omitempty"`
|
|
// Allow userns creation and container setup syscalls.
|
|
Userns bool `json:"userns,omitempty"`
|
|
// Share host net namespace.
|
|
HostNet bool `json:"host_net,omitempty"`
|
|
// Share abstract unix socket scope.
|
|
HostAbstract bool `json:"host_abstract,omitempty"`
|
|
// Allow dangerous terminal I/O (faking input).
|
|
Tty bool `json:"tty,omitempty"`
|
|
// Allow multiarch.
|
|
Multiarch bool `json:"multiarch,omitempty"`
|
|
|
|
// Initial process environment variables.
|
|
Env map[string]string `json:"env"`
|
|
|
|
/* Map target user uid to privileged user uid in the container user namespace.
|
|
|
|
Some programs fail to connect to dbus session running as a different uid,
|
|
this option works around it by mapping priv-side caller uid in container. */
|
|
MapRealUID bool `json:"map_real_uid"`
|
|
|
|
// Mount /dev/ from the init mount namespace as-is in the container mount namespace.
|
|
Device bool `json:"device,omitempty"`
|
|
|
|
/* Container mount points.
|
|
|
|
If the first element targets /, it is inserted early and excluded from path hiding. */
|
|
Filesystem []FilesystemConfigJSON `json:"filesystem"`
|
|
|
|
// String used as the username of the emulated user, validated against the default NAME_REGEX from adduser.
|
|
// Defaults to passwd name of target uid or chronos.
|
|
Username string `json:"username,omitempty"`
|
|
// Pathname of shell in the container filesystem to use for the emulated user.
|
|
Shell *check.Absolute `json:"shell"`
|
|
// Directory in the container filesystem to enter and use as the home directory of the emulated user.
|
|
Home *check.Absolute `json:"home"`
|
|
|
|
// Pathname to executable file in the container filesystem.
|
|
Path *check.Absolute `json:"path,omitempty"`
|
|
// Final args passed to the initial program.
|
|
Args []string `json:"args"`
|
|
}
|