doos 1.1.0: limits, hardening, pasta, signatures, Debian image

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/container.hpp

@@ -21,8 +21,13 @@ struct Options {
     std::optional<std::string> image;
     std::optional<IdMode> ids;
     std::optional<std::uint64_t> size;
+    std::optional<std::uint64_t> memory;
+    std::optional<std::uint32_t> pids;
+    std::optional<std::uint32_t> milliCpus;  // 0 = all cores
+    std::optional<bool> relaxed;             // --hardening relaxed
 };
 
+
 class Container {
 public:
     Container(std::filesystem::path dir, std::string name) : dir_(std::move(dir)), name_(std::move(name)) {}
@@ -47,8 +52,14 @@ public:
     IdMode ids() const { return ids_; }
     std::uint64_t sizeCap() const { return size_; }
     void setSizeCap(std::uint64_t bytes);
+    std::uint64_t memoryCap() const { return memory_; }
+    std::uint32_t pidsCap() const { return pids_; }
+    std::uint32_t milliCpus() const { return milliCpus_; }
+    bool relaxed() const { return relaxed_; }
+    // Limits take effect the next time the container starts.
+    void setLimits(std::optional<std::uint64_t> memory, std::optional<std::uint32_t> pids, std::optional<std::uint32_t> milliCpus);
 
-    void create(const NetMode& net, const std::string& image, IdMode ids, std::uint64_t size);
+    void create(const NetMode& net, const std::string& image, IdMode ids, const Options& resolved);
     void readMeta();  // meta only, no side effects
     void load();      // readMeta + heal the layout
 
@@ -60,6 +71,7 @@ public:
     // Mountpoints, layer dirs, and one-time seeding (skeleton, /etc copy). Idempotent.
     void prepareLayout() const;
     // Bytes the container wrote (writable layers and private dirs), as the host user can see them.
+    // Measured from inside the id map, so directories of other container ids are counted too.
     std::uint64_t usedBytes(std::size_t& skipped) const;
 
 private:
@@ -73,6 +85,10 @@ private:
     std::string image_;
     IdMode ids_ = IdMode::Single;
     std::uint64_t size_ = 0;
+    std::uint64_t memory_ = 0;
+    std::uint32_t pids_ = 0;
+    std::uint32_t milliCpus_ = 0;
+    bool relaxed_ = false;
 };
 
 class Store {