retoor/doos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

doos 1.1.0: limits, hardening, pasta, signatures, Debian image

Browse Source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
retoor
2026-10-23 21:59:26 +02:00
co-authored by Claude Sonnet 5.5
parent d446c29372
commit 530582e826
24 changed files with 1182 additions and 127 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/spec.hpp
+42 -1
View File
@@ -25,10 +25,22 @@ constexpr std::uint64_t kMinSizeBytes = 64ULL << 20;
constexpr std::uint64_t kMaxSizeBytes = 1ULL << 40;
constexpr int kSizeWarnPercent = 80;
constexpr int kSizeThawPercent = 95; // thaw again below this share of the cap
constexpr int kSizeCheckIntervalMs = 10000; // floor between usage scans, never faster
constexpr int kSizeCheckMinIntervalMs = 2000; // floor between usage scans, never faster
constexpr int kSizeScanDutyFactor = 10; // next scan waits at least 10x the last scan's duration
constexpr std::size_t kMaxScanEntries = 5000000; // usage scan stops (and reports) beyond this
constexpr std::string_view kCgroupDir = "doos"; // under the delegated user@UID.service cgroup
// Resource limits per container (--memory, --pids, --cpus). Enforced by cgroup v2; cpus 0 means "all cores".
constexpr std::uint64_t kDefaultMemoryBytes = 8ULL << 30;
constexpr std::uint64_t kMinMemoryBytes = 64ULL << 20;
constexpr std::uint64_t kMaxMemoryBytes = 1ULL << 40;
constexpr std::uint32_t kDefaultPids = 4096;
constexpr std::uint32_t kMinPids = 16;
constexpr std::uint32_t kMaxPids = 4194304;
constexpr std::uint32_t kMaxMilliCpus = 1024000; // 1024 cpus
constexpr std::uint32_t kMinMilliCpus = 100; // 0.1 cpu
constexpr int kCpuPeriodUs = 100000;
// Seeding limits
constexpr std::size_t kMaxSkeletonDirs = 200000;
constexpr std::size_t kMaxEtcCopyFiles = 50000;
@@ -47,6 +59,16 @@ constexpr std::size_t kMaxCaptureBytes = 1 << 20; // listing / checksum fetches
constexpr std::string_view kAlpineBase = "https://dl-cdn.alpinelinux.org/alpine/latest-stable/releases/";
constexpr std::string_view kUbuntuBase = "https://cdimage.ubuntu.com/ubuntu-base/releases/";
constexpr std::string_view kUbuntuDefaultVersion = "26.04";
constexpr std::string_view kDebianBase = "https://raw.githubusercontent.com/debuerreotype/docker-debian-artifacts/";
constexpr std::string_view kDebianDefaultRelease = "trixie";
// Release signing keys, pinned by fingerprint. Keys are fetched from the publisher and rejected unless the
// fingerprint matches. Sources of the fingerprints: alpinelinux.org/downloads, ubuntu.com verify tutorial.
constexpr std::string_view kAlpineKeyUrl = "https://alpinelinux.org/keys/ncopa.asc";
constexpr std::string_view kAlpineKeyFpr = "0482D84022F52DF1C4E7CD43293ACD0907D9495A";
constexpr std::string_view kUbuntuKeyUrl =
"https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x843938DF228D22F7B3742BC0D94AA3F0EFE21092";
constexpr std::string_view kUbuntuKeyFpr = "843938DF228D22F7B3742BC0D94AA3F0EFE21092";
// Networking
constexpr std::string_view kSlirpBinary = "slirp4netns";
@@ -65,6 +87,25 @@ constexpr std::array<std::string_view, 2> kOverlayDirs = {"/usr", "/opt"};
// chown --reference and in-place edits work). Unreadable entries are skipped and counted.
constexpr std::array<std::string_view, 1> kCopiedDirs = {"/etc"};
// Host mode /etc under --hardening default: only these entries are copied (relaxed copies everything readable).
// Entries that may hold credentials are skipped even inside allowed directories.
constexpr std::array<std::string_view, 53> kEtcAllow = {
"passwd", "group", "nsswitch.conf", "hosts", "hostname", "host.conf", "localtime", "timezone", "machine-id",
"ld.so.conf", "ld.so.conf.d", "ld.so.cache", "ssl", "ca-certificates", "ca-certificates.conf", "pki",
"alternatives", "apt", "dpkg", "bash.bashrc", "bashrc", "profile", "profile.d", "environment", "inputrc",
"os-release", "lsb-release", "issue", "issue.net", "debian_version", "shells", "protocols", "services",
"mime.types", "magic", "gai.conf", "locale.gen", "locale.conf", "default", "gitconfig", "bash_completion",
"bash_completion.d", "vim", "emacs", "xdg", "fonts", "mailcap", "wgetrc", "ssh/ssh_config",
"ssh/ssh_config.d", "perl", "python3", "terminfo"};
constexpr std::array<std::string_view, 8> kEtcDenyNames = {"private", "shadow", "gshadow", "sudoers", "sudoers.d",
"auth.conf", "auth.conf.d", "ssh_host_*"};
// Capabilities kept in the bounding set under --hardening default (the Docker default set).
constexpr std::array<int, 14> kKeptCaps = {0 /*CHOWN*/, 1 /*DAC_OVERRIDE*/, 3 /*FOWNER*/, 4 /*FSETID*/,
5 /*KILL*/, 6 /*SETGID*/, 7 /*SETUID*/, 8 /*SETPCAP*/,
10 /*NET_BIND_SERVICE*/, 13 /*NET_RAW*/, 18 /*SYS_CHROOT*/,
27 /*MKNOD*/, 29 /*AUDIT_WRITE*/, 31 /*SETFCAP*/};
// Extra overlay mounted inside the private /var, only when the host has the directory (dpkg database).
constexpr std::array<std::string_view, 1> kVarOverlayDirs = {"/var/lib/dpkg"};