Skip to content

Commit c3de134

Browse files
committed
Merge branch 'extend-seccomp-program' of github.com:sat0ken/youki into extend-seccomp-program
2 parents 94970e2 + 05f5e23 commit c3de134

File tree

275 files changed

+19122
-5327
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

275 files changed

+19122
-5327
lines changed

.devcontainer/Dockerfile

Lines changed: 21 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,25 +14,41 @@ EOF
1414

1515
RUN <<EOF
1616
apt-get update
17+
18+
# For building
1719
apt-get install -y \
18-
# For building
1920
build-essential \
2021
git \
2122
libclang-dev \
2223
libelf-dev \
2324
libseccomp-dev \
2425
libssl-dev \
2526
libsystemd-dev \
26-
pkg-config \
27-
# For debugging
28-
bpftrace \
29-
podman
27+
pkg-config
28+
29+
# For debugging
30+
apt-get install -y \
31+
podman \
32+
bpftrace
33+
34+
# Since systemd is not running inside the Dev Container,
35+
# but the default events_logger for podman is set to journald, container startup fails.
36+
# Therefore, change it to file.
37+
sudo sed -i 's/^# events_logger = "journald"/events_logger = "file"/' /usr/share/containers/containers.conf
3038

3139
curl --proto '=https' --tlsv1.2 -sSf https://just.systems/install.sh | bash -s -- --to /usr/bin
3240

41+
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
42+
chmod +x kubectl
43+
mv ./kubectl /usr/bin/kubectl
44+
3345
# nightly build is required for `cargo fmt` as `rustfmt.toml` uses unstable features.
3446
curl https://sh.rustup.rs -sSf | sh -s -- -y
3547
rustup install nightly
3648
rustup component add rustfmt
3749
rustup component add clippy
50+
51+
# Install mdbook
52+
VERSION=$(curl -sSfL https://api.github.com/repos/rust-lang/mdBook/releases/latest | jq -r .tag_name)
53+
curl -sSfL https://github.com/rust-lang/mdBook/releases/download/$VERSION/mdbook-$VERSION-$(uname -m)-unknown-linux-musl.tar.gz | tar -xzvC /usr/bin/ mdbook
3854
EOF
Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"features": {
3+
"ghcr.io/devcontainers/features/common-utils:2": {
4+
"version": "2.5.4",
5+
"resolved": "ghcr.io/devcontainers/features/common-utils@sha256:00fd45550f578d9d515044d9e2226e908dbc3d7aa6fcb9dee4d8bdb60be114cf",
6+
"integrity": "sha256:00fd45550f578d9d515044d9e2226e908dbc3d7aa6fcb9dee4d8bdb60be114cf"
7+
},
8+
"ghcr.io/devcontainers/features/docker-in-docker:2": {
9+
"version": "2.12.2",
10+
"resolved": "ghcr.io/devcontainers/features/docker-in-docker@sha256:842d2ed40827dc91b95ef727771e170b0e52272404f00dba063cee94eafac4bb",
11+
"integrity": "sha256:842d2ed40827dc91b95ef727771e170b0e52272404f00dba063cee94eafac4bb"
12+
}
13+
}
14+
}

.devcontainer/devcontainer.json

Lines changed: 14 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,34 @@
11
{
22
"name": "Youki",
3-
"extensions": [
4-
"rust-analyzer"
5-
],
6-
"features": {
7-
"ghcr.io/devcontainers/features/docker-in-docker:2": {}
8-
},
9-
"customizations": {
3+
"features": {
4+
"ghcr.io/devcontainers/features/docker-in-docker:2": {}
5+
},
6+
"customizations": {
107
"vscode": {
11-
"settings": {
8+
"settings": {
129
"lldb.executable": "/usr/bin/lldb",
1310
"files.watcherExclude": {
1411
"**/target/**": true
1512
},
16-
"rust-analyzer.checkOnSave.command": "clippy"
13+
"rust-analyzer.check": {
14+
"command": "clippy"
15+
}
1716
},
18-
1917
"extensions": [
2018
"vadimcn.vscode-lldb",
2119
"mutantdino.resourcemonitor",
2220
"rust-lang.rust-analyzer",
2321
"tamasfe.even-better-toml",
24-
"serayuzgur.crates"
22+
"fill-labs.dependi"
2523
]
2624
}
2725
},
2826
"privileged": true,
29-
"runArgs": [
30-
"--name",
31-
"youki-devcontainer"
32-
],
33-
"build": {
27+
"runArgs": [
28+
"--name",
29+
"youki-devcontainer"
30+
],
31+
"build": {
3432
"dockerfile": "Dockerfile"
3533
}
3634
}

.github/workflows/basic.yml

Lines changed: 71 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -11,29 +11,72 @@ on:
1111

1212
jobs:
1313
changes:
14-
runs-on: ubuntu-22.04
14+
runs-on: ubuntu-24.04
1515
timeout-minutes: 15
1616
outputs:
1717
any_modified: ${{ steps.filter.outputs.any_modified }}
1818
steps:
1919
- uses: actions/checkout@v4
20-
- uses: tj-actions/changed-files@v41
21-
id: filter
2220
with:
23-
files_ignore: |
24-
docs
25-
LICENSE
26-
**.md
21+
fetch-depth: 0 # Required to get full history
22+
# Using Git commands instead of tj-actions/changed-files
23+
- name: Get changed files
24+
id: filter
25+
run: |
26+
# grep will exit with non-zero if no matching pattern
27+
# but we are ok with that, so to prevent workflow failing
28+
# we set allow errors
29+
set +e
30+
31+
# Change the base commit depending on event type
32+
if [[ "${{ github.event_name }}" == "push" ]]; then
33+
# For push events
34+
if [[ -n "${{ github.event.before }}" ]]; then
35+
BASE_COMMIT="${{ github.event.before }}"
36+
else
37+
# For workflow dispatch, etc.
38+
git fetch origin main --depth=1
39+
BASE_COMMIT="origin/main"
40+
fi
41+
elif [[ "${{ github.event_name }}" == "pull_request" ]]; then
42+
# For pull request events
43+
git fetch origin "${{ github.base_ref }}" --depth=1
44+
BASE_COMMIT="origin/${{ github.base_ref }}"
45+
else
46+
# For workflow dispatch events
47+
git fetch origin main --depth=1
48+
BASE_COMMIT="HEAD~1"
49+
fi
50+
51+
echo "Using base commit: $BASE_COMMIT"
52+
53+
# Get changed files and filter out the ones to ignore
54+
ALL_CHANGED_FILES=$(git diff --name-only --diff-filter=ACMRT "$BASE_COMMIT" HEAD)
55+
FILTERED_FILES=$(echo "$ALL_CHANGED_FILES" | grep -v -E '^docs/|^LICENSE$|\.md$')
56+
57+
# Set the results
58+
if [[ -n "$FILTERED_FILES" ]]; then
59+
echo "any_modified=true" >> $GITHUB_OUTPUT
60+
echo "all_modified_files<<EOF" >> $GITHUB_OUTPUT
61+
echo "$FILTERED_FILES" >> $GITHUB_OUTPUT
62+
echo "EOF" >> $GITHUB_OUTPUT
63+
else
64+
echo "any_modified=false" >> $GITHUB_OUTPUT
65+
echo "all_modified_files=" >> $GITHUB_OUTPUT
66+
fi
2767
- name: List all changed files
2868
run: |
29-
for file in ${{ steps.filter.outputs.all_modified_files }}; do
30-
echo "$file was changed"
31-
done
69+
if [[ "${{ steps.filter.outputs.any_modified }}" == "true" ]]; then
70+
echo "Changed files detected:"
71+
echo "${{ steps.filter.outputs.all_modified_files }}"
72+
else
73+
echo "No relevant changes detected"
74+
fi
3275
3376
check:
3477
needs: [changes]
3578
if: needs.changes.outputs.any_modified == 'true'
36-
runs-on: ubuntu-22.04
79+
runs-on: ubuntu-24.04
3780
timeout-minutes: 15
3881
strategy:
3982
matrix:
@@ -48,24 +91,28 @@ jobs:
4891
- name: Install nightly rustfmt
4992
run: rustup toolchain install nightly --component rustfmt --profile minimal --no-self-update
5093
- name: typos-action
51-
uses: crate-ci/typos@v1.22.9
94+
uses: crate-ci/typos@v1.32.0
5295
- name: Install just
5396
uses: taiki-e/install-action@just
5497
- name: Install cross-rs
55-
run: cargo install cross --git https://github.com/cross-rs/cross
98+
run: RUSTFLAGS="" cargo install cross --git https://github.com/cross-rs/cross
5699
- name: Setup target
57100
run: |
58101
echo "CARGO=cross" >> ${GITHUB_ENV}
59102
echo "TARGET=${{ matrix.arch }}-unknown-linux-${{ matrix.libc }}" >> ${GITHUB_ENV}
60103
- name: Check formatting and lints
61104
run: just lint
105+
- name: Install cargo machete
106+
uses: taiki-e/install-action@v2
107+
with:
108+
tool: cargo-machete@0.7.0
62109
- name: Check unused deps
63-
uses: bnjbvr/cargo-machete@v0.7.0
110+
run: cargo machete
64111

65112
tests:
66113
needs: [changes]
67114
if: needs.changes.outputs.any_modified == 'true'
68-
runs-on: ubuntu-22.04
115+
runs-on: ubuntu-24.04
69116
timeout-minutes: 20
70117
strategy:
71118
matrix:
@@ -78,11 +125,17 @@ jobs:
78125
- name: Install just
79126
uses: taiki-e/install-action@just
80127
- name: Install cross-rs
81-
run: cargo install cross --git https://github.com/cross-rs/cross
82-
- name: Setup target
128+
run: RUSTFLAGS="" cargo install cross --git https://github.com/cross-rs/cross
129+
- name: Create test user
130+
# Create user and home directory for tests that require them
131+
run: sudo useradd -m -d /tmp/testuser testuser
132+
- name: Setup environment variables
83133
run: |
84134
echo "CARGO=cross" >> ${GITHUB_ENV}
85135
echo "TARGET=${{ matrix.arch }}-unknown-linux-${{ matrix.libc }}" >> ${GITHUB_ENV}
136+
echo "TEST_NON_ROOT_UID=$(id -u testuser)" >> ${GITHUB_ENV}
137+
- name: Disable AppArmor restrictions
138+
run: echo 0 | sudo tee /proc/sys/kernel/apparmor_restrict_unprivileged_userns
86139
- name: Run tests
87140
run: just test-basic
88141
- name: Run feature tests
@@ -94,7 +147,7 @@ jobs:
94147
# coverage:
95148
# needs: [changes]
96149
# if: needs.changes.outputs.any_modified == 'true'
97-
# runs-on: ubuntu-22.04
150+
# runs-on: ubuntu-24.04
98151
# timeout-minutes: 20
99152
# name: Run test coverage
100153
# steps:

.github/workflows/benchmark_execution_time.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ on:
77
jobs:
88
building-pr-branch:
99
if: (github.event.issue.pull_request != null) && github.event.comment.body == '!github easy-benchmark'
10-
runs-on: ubuntu-20.04
10+
runs-on: ubuntu-24.04
1111
timeout-minutes: 15
1212

1313
steps:
@@ -34,7 +34,7 @@ jobs:
3434

3535
building-main-branch:
3636
if: (github.event.issue.pull_request != null) && github.event.comment.body == '!github easy-benchmark'
37-
runs-on: ubuntu-20.04
37+
runs-on: ubuntu-24.04
3838
timeout-minutes: 15
3939

4040
steps:
@@ -65,7 +65,7 @@ jobs:
6565
needs:
6666
- building-pr-branch
6767
- building-main-branch
68-
runs-on: ubuntu-20.04
68+
runs-on: ubuntu-24.04
6969
timeout-minutes: 15
7070

7171
steps:

.github/workflows/dependabot_auto.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,9 @@ jobs:
3030
PR_URL: ${{ github.event.pull_request.html_url }}
3131
PR_TITLE: ${{ github.event.pull_request.title }}
3232
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
33+
# This is needed otherwise the pr edit fails for some reason
34+
# see https://github.com/cli/cli/issues/7558
35+
GH_REPO: ${{ github.repository_owner }}/${{ github.event.repository.name }}
3336
- name: Automerge
3437
id: automerge
3538
uses: pascalgn/automerge-action@v0.15.6

.github/workflows/docs.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ on:
77

88
jobs:
99
changes:
10-
runs-on: ubuntu-20.04
10+
runs-on: ubuntu-24.04
1111
timeout-minutes: 15
1212
outputs:
1313
dirs: ${{ steps.filter.outputs.changes }}
@@ -21,7 +21,7 @@ jobs:
2121
deploy:
2222
needs: [changes]
2323
if: ${{ !contains(needs.changes.outputs.dirs, '[]') }}
24-
runs-on: ubuntu-20.04
24+
runs-on: ubuntu-24.04
2525
timeout-minutes: 15
2626
concurrency:
2727
group: ${{ github.workflow }}-${{ github.ref }}

0 commit comments

Comments
 (0)