doos 1.0.0: images, size cap, subuid ids, working apt in host mode

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/run.sh

@@ -57,5 +57,67 @@ wait; sleep 0.5
 "$DOOS" delete t | grep -q "dry run" && [ -d "$DOOS_HOME/containers/t" ] && ok "delete is dry-run" || bad "delete is dry-run"
 "$DOOS" delete --yes t | grep -q deleted && [ ! -e "$DOOS_HOME/containers/t" ] && ok "delete --yes removes" || bad "delete --yes removes"
 
+# ---- 1.0: skeleton, seeded /etc, uid mapping (host mode, container t was deleted above)
+"$DOOS" get_or_create s >/dev/null 2>&1
+outs() { "$DOOS" attach s -- sh -c "$1" 2>&1; }
+[ "$(outs 'touch /usr/bin/doos-x && echo y')" = "y" ] && [ ! -e /usr/bin/doos-x ] && ok "skeleton: write into /usr/bin" || bad "skeleton: write into /usr/bin"
+[ "$(outs 'stat -c %u /etc/shells')" = "0" ] && ok "/etc owned by container root" || bad "/etc owned by container root"
+[ "$(outs 'chown 100:100 /root && stat -c %u:%g /root')" = "100:100" ] && ok "subuid: chown to other ids" || bad "subuid: chown to other ids"
+[ "$(outs 'ls /var/lib/dpkg/status >/dev/null && echo y')" = "y" ] && ok "/var/lib/dpkg present" || bad "/var/lib/dpkg present"
+"$DOOS" get_or_create --ids single s1 >/dev/null 2>&1
+[ "$("$DOOS" attach s1 -- cat /proc/self/uid_map | wc -l)" = "1" ] && ok "ids single: one mapping" || bad "ids single: one mapping"
+"$DOOS" attach s1 -- sh -c 'cat /etc/apt/apt.conf.d/99doos-sandbox' 2>&1 | grep -q 'Sandbox::User "root"' && ok "ids single: apt sandbox override" || bad "ids single: apt sandbox override"
+check "ids fixed at creation"       bash -c "! '$DOOS' get_or_create --ids subuid s1"
+check "bad size rejected"           bash -c "! '$DOOS' get_or_create --size 1x z1"
+check "size below minimum rejected" bash -c "! '$DOOS' get_or_create --size 1m z2"
+"$DOOS" attach s -- sh -c 'apt-get update >/dev/null 2>&1; apt-get install -y --no-install-recommends cowsay >/dev/null 2>&1; dpkg --audit && /usr/games/cowsay ok >/dev/null' && ok "host mode: apt install completes" || bad "host mode: apt install completes"
+[ ! -e /usr/games/cowsay ] && ok "host untouched by apt install" || bad "host untouched by apt install"
+"$DOOS" delete --yes s >/dev/null; "$DOOS" delete --yes s1 >/dev/null
+
+# ---- images
+echo "--- images (network)"
+"$DOOS" image list | grep -q "alpine.*available" && ok "image list shows catalog" || bad "image list shows catalog"
+check "http url refused"            bash -c "! '$DOOS' image add http://example.com/x.tar.gz"
+check "url without sha256 refused"  bash -c "! '$DOOS' image add https://example.com/x.tar.gz"
+check "unknown image refused"       bash -c "! '$DOOS' get_or_create --image nosuch i0"
+tmpd=$(mktemp -d); mkdir -p $tmpd/r/bin; echo hi > $tmpd/r/bin/f; tar -C $tmpd/r -czf $tmpd/mini.tar.gz .
+check "wrong sha256 rejected"       bash -c "! '$DOOS' image add --sha256 $(printf '0%.0s' $(seq 64)) $tmpd/mini.tar.gz mini"
+[ ! -e "$DOOS_HOME/images/mini" ] && [ ! -e "$DOOS_HOME/images/.tmp-mini" ] && ok "failed add leaves nothing" || bad "failed add leaves nothing"
+check "local tar added"             "$DOOS" image add $tmpd/mini.tar.gz mini
+rm -rf $tmpd; "$DOOS" image delete --yes mini >/dev/null
+
+"$DOOS" attach --image alpine a1 -- true >/dev/null 2>&1
+"$DOOS" image list | grep -q "alpine.*installed" && ok "image auto-fetched on demand" || bad "image auto-fetched on demand"
+[ "$("$DOOS" attach a1 -- sh -c '. /etc/os-release; echo $ID')" = "alpine" ] && ok "alpine image runs" || bad "alpine image runs"
+"$DOOS" attach a1 -- sh -c 'apk add --no-cache jq >/dev/null 2>&1 && jq --version' | grep -q jq && ok "alpine: apk add" || bad "alpine: apk add"
+[ "$("$DOOS" attach a1 -- sh -c 'chown 100:100 /root && stat -c %u /root')" = "100" ] && ok "image: subuid chown" || bad "image: subuid chown"
+"$DOOS" attach a1 -- sh -c 'exec 3<>/dev/tcp/1.1.1.1/443' >/dev/null 2>&1; "$DOOS" attach a1 -- sh -c 'wget -qO- https://example.com | grep -q html' && ok "image: network + dns" || bad "image: network + dns"
+check "image delete refused while used" bash -c "! '$DOOS' image delete --yes alpine"
+check "image in use is a dry run too"   bash -c "! '$DOOS' image delete alpine"
+"$DOOS" get_or_create --image alpine --ids single a2 >/dev/null 2>&1 && bad "image ids mismatch rejected" || ok "image ids mismatch rejected"
+"$DOOS" delete --yes a1 >/dev/null
+"$DOOS" image delete alpine | grep -q "dry run" && [ -d "$DOOS_HOME/images/alpine" ] && ok "image delete is dry-run" || bad "image delete is dry-run"
+"$DOOS" image delete --yes alpine | grep -q deleted && [ ! -e "$DOOS_HOME/images/alpine" ] && ok "image delete --yes removes" || bad "image delete --yes removes"
+
+"$DOOS" attach --image ubuntu u1 -- sh -c 'apt-get update >/dev/null 2>&1; apt-get install -y --no-install-recommends cowsay >/dev/null 2>&1; dpkg --audit && /usr/games/cowsay ok >/dev/null' && ok "ubuntu image: apt install completes" || bad "ubuntu image: apt install completes"
+"$DOOS" delete --yes u1 >/dev/null; "$DOOS" image delete --yes ubuntu >/dev/null
+
+# ---- size cap (needs cgroup v2 delegation; takes about 40 s because the scan interval has a 10 s floor)
+echo "--- size cap"
+"$DOOS" get_or_create --image alpine --size 64m cap >/dev/null 2>&1
+"$DOOS" attach cap -- sh -c 'dd if=/dev/zero of=/root/big bs=1M count=100 2>/dev/null; sleep 40' >/tmp/doos-cap.$$ 2>&1 &
+sleep 15
+if grep -q "FROZEN" /tmp/doos-cap.$$; then
+  ok "size cap freezes"
+  "$DOOS" attach cap -- rm /root/big >/dev/null 2>&1; sleep 12
+  grep -q thawed /tmp/doos-cap.$$ && ok "size cap thaws after cleanup" || bad "size cap thaws after cleanup"
+elif grep -q "cannot freeze" /tmp/doos-cap.$$; then
+  echo "skip size cap: no cgroup delegation here (warn-only mode confirmed)"
+else
+  bad "size cap freezes"
+fi
+kill %% 2>/dev/null; wait 2>/dev/null; rm -f /tmp/doos-cap.$$
+"$DOOS" delete --yes cap >/dev/null 2>&1; "$DOOS" image delete --yes alpine >/dev/null 2>&1
+
 echo "passed=$pass failed=$fail"
 [ "$fail" -eq 0 ]