doos 0.1.0: user-level overlayfs containers with slirp networking

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/spec.hpp

@@ -0,0 +1,52 @@
+// Single source of truth for limits and layout. Mirrors SPEC.md; change both together.
+#pragma once
+#include <array>
+#include <cstddef>
+#include <string_view>
+
+namespace spec {
+
+// Hard caps
+constexpr std::size_t kMaxContainers = 64;
+constexpr std::size_t kMaxNameLen = 32;
+constexpr std::size_t kMaxCommandArgs = 256;
+constexpr std::size_t kMaxTreeDepth = 256;       // removal recursion cap
+constexpr unsigned long kMaxOpenFiles = 4096;    // RLIMIT_NOFILE ceiling inside
+constexpr int kNetReadyTimeoutMs = 5000;         // slirp4netns must be ready by then
+constexpr int kLockTimeoutMs = 5000;             // per-container lock wait
+constexpr std::string_view kTmpSize = "256m";
+constexpr std::string_view kRunSize = "64m";
+constexpr std::string_view kShmSize = "64m";
+
+// Networking
+constexpr std::string_view kSlirpBinary = "slirp4netns";
+constexpr std::string_view kSlirpDns = "10.0.2.3";
+constexpr std::string_view kSlirpTapName = "tap0";
+
+// Container identity
+constexpr std::string_view kContainerPath =
+    "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+constexpr std::string_view kHome = "/root";
+
+// Host directories exposed as overlay lowerdirs. Writes land in the per-container upperdir.
+constexpr std::array<std::string_view, 3> kOverlayDirs = {"/usr", "/etc", "/opt"};
+
+// Host top-level entries: recreated as symlinks when the host has them as symlinks (usr-merge),
+// overlaid like kOverlayDirs when they are real directories, skipped when absent.
+constexpr std::array<std::string_view, 5> kCompatDirs = {"/bin", "/sbin", "/lib", "/lib32", "/lib64"};
+
+// Persistent per-container private directories (no host lower layer).
+constexpr std::array<std::string_view, 2> kPrivateDirs = {"/root", "/var"};
+
+// Empty mountpoints / tmpfs
+constexpr std::array<std::string_view, 6> kEmptyDirs = {"/mnt", "/srv", "/tmp", "/run", "/dev", "/proc"};
+
+// Host device nodes bound into the container /dev (no mknod possible in a userns).
+constexpr std::array<std::string_view, 6> kDevices = {"null", "zero", "full", "random", "urandom", "tty"};
+
+// /proc paths remounted read-only, or hidden behind /dev/null.
+constexpr std::array<std::string_view, 5> kProcReadOnly = {"/proc/sys", "/proc/sysrq-trigger", "/proc/irq",
+                                                           "/proc/bus", "/proc/fs"};
+constexpr std::array<std::string_view, 3> kProcMasked = {"/proc/kcore", "/proc/keys", "/proc/timer_list"};
+
+}  // namespace spec