doos 1.1.0: limits, hardening, pasta, signatures, Debian image

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/cgroup.hpp

@@ -1,29 +1,50 @@
 #pragma once
 #include <sys/types.h>
 
+#include <cstdint>
 #include <filesystem>
 #include <memory>
 #include <string>
 
 namespace doos {
 
-// One cgroup v2 leaf per running container, under the cgroup delegated to the user's systemd manager.
-// Used to freeze a container that hit its size cap (freezing needs no controller). Best effort:
-// create() returns null when delegation is absent, and the caller must say so.
+struct Limits {
+    std::uint64_t memoryBytes = 0;  // 0 = not limited
+    std::uint32_t pids = 0;
+    std::uint32_t milliCpus = 0;    // 0 = all cores
+};
+
+// cgroup v2 subtree of one running container under the cgroup delegated to the user's systemd manager:
+//
+//   doos/<name>/        limits live here (memory.max, pids.max, cpu.max), no processes
+//     main/             the container's init and everything it starts; frozen when the size cap is hit
+//     shell/            processes started by later `doos attach` calls; never frozen (rescue path), same limits
+//
+// Best effort: create() returns null when delegation is absent, and the caller must say why.
 class Cgroup {
 public:
-    static std::unique_ptr<Cgroup> create(const std::string& name, std::string& whyNot);
+    static std::unique_ptr<Cgroup> create(const std::string& name, const Limits& limits, std::string& whyNot,
+                                          std::string& notEnforced);
+    // Existing group of a running container, for joiners. Null when none.
+    static std::unique_ptr<Cgroup> open(const std::string& name);
     ~Cgroup();
     Cgroup(const Cgroup&) = delete;
     Cgroup& operator=(const Cgroup&) = delete;
 
-    void add(pid_t pid) const;
+    void addMain(pid_t pid) const;
+    void addShell(pid_t pid) const;
     void freeze(bool on) const;
     bool frozen() const { return frozen_; }
+    // Number of OOM kills and of fork failures at the pids limit since creation.
+    std::uint64_t oomKills() const;
+    std::uint64_t pidFailures() const;
 
 private:
-    explicit Cgroup(std::filesystem::path dir) : dir_(std::move(dir)) {}
+    Cgroup(std::filesystem::path dir, bool owner) : dir_(std::move(dir)), owner_(owner) {}
+    static std::filesystem::path base(std::string& whyNot);
+    std::uint64_t counter(const char* file, const char* key) const;
     std::filesystem::path dir_;
+    bool owner_;
     mutable bool frozen_ = false;
 };