36 lines
965 B
C++
36 lines
965 B
C++
#pragma once
|
|
#include <string>
|
|
#include <vector>
|
|
|
|
#include "container.hpp"
|
|
#include "util.hpp"
|
|
|
|
namespace doos {
|
|
|
|
class Cgroup;
|
|
|
|
// Runs a command inside a container: starts the namespaces if the container is
|
|
// stopped, joins them if it is already running. Returns the command's exit code.
|
|
class Sandbox {
|
|
public:
|
|
Sandbox(Container container, std::vector<std::string> command)
|
|
: container_(std::move(container)), command_(std::move(command)) {}
|
|
|
|
int run();
|
|
|
|
// AppArmor profile (text) that lets this very binary use user namespaces on Ubuntu 24.04+.
|
|
static std::string apparmorProfile();
|
|
// Shell command that installs it; shown when a start fails because of AppArmor.
|
|
static std::string apparmorInstallHint();
|
|
|
|
private:
|
|
int start(FileLock& lock);
|
|
int watch(pid_t child, Cgroup* cgroup);
|
|
int join(pid_t initPid, FileLock& lock);
|
|
|
|
Container container_;
|
|
std::vector<std::string> command_;
|
|
};
|
|
|
|
} // namespace doos
|