hakoniwa 1.6.0

Process isolation for Linux using namespaces, resource limits, cgroups, landlock and seccomp.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

mod network;
mod pasta;

use nix::unistd::Pid;
use std::process::Command;

use crate::{Container, error::*};

pub use network::Network;
pub use pasta::Pasta;

pub(crate) fn mainp_setup(container: &Container, child: Pid) -> Result<()> {
    let network = &container
        .network
        .clone()
        .expect("Container#network is some");
    match network {
        Network::Pasta(pasta) => mainp_setup_pasta(pasta, child)?,
    }

    log::debug!("================================");
    Ok(())
}

fn mainp_setup_pasta(pasta: &Pasta, child: nix::unistd::Pid) -> Result<()> {
    let cmdline = pasta.to_cmdline(child);
    log::debug!("Configuring Network: Execve: {cmdline:?}");

    let output = Command::new(cmdline[0].clone())
        .args(&cmdline[1..])
        .output();
    match output {
        Ok(output) if output.status.success() => {
            let output = format!("\n{}", String::from_utf8_lossy(&output.stderr).trim());
            log::debug!("Configuring Network: Output: {output}");
            Ok(())
        }
        Ok(output) => {
            let errmsg = format!("\n{}", String::from_utf8_lossy(&output.stderr).trim());
            Err(ProcessErrorKind::SetupNetworkFailed(errmsg))?
        }
        Err(err) if err.kind() == std::io::ErrorKind::NotFound => {
            let errmsg = format!("command {:?} not found", pasta.prog);
            Err(ProcessErrorKind::SetupNetworkFailed(errmsg))?
        }
        Err(err) => {
            let errmsg = format!("{err}");
            Err(ProcessErrorKind::SetupNetworkFailed(errmsg))?
        }
    }
}