Conch/internal/daemon · Yekelu/Conch

文件	最后提交记录	最后更新时间
state	feat(network): add configurable sandbox policies Sandboxes previously inherited unrestricted network behavior from warm network slots, with no API for per-sandbox ingress or egress controls. Slot reuse could also retain policy and conntrack state across sandbox assignments. Add typed allow and deny configuration across the daemon, runtime service, persistent state, and Python SDK. Validate destinations before slot allocation and apply live changes with batched iptables updates. Compensate persistent state when updates fail, and clear policy and conntrack state before returning slots to the warm pool. Co-authored-by: Yifan Zhao <stopire@gmail.com> Assisted-by: Codex:GPT-5.6-sol Signed-off-by: Yifan Zhao <stopire@gmail.com>	1 个月前
daemon.go	feat: manage conch cow lifecycle	1 个月前
handler_image_test.go	refactor(image): move boot index unpack to templates Image commands exposed archive transfer and unpacking for both OCI images and Conch Boot Indexes, although only template workflows need explicit unpacking. This blurred ownership and retained snapshot metadata and recovery behavior that the runtime no longer uses. Remove archive transfer and OCI image unpack APIs. Move explicit Boot Index unpacking to `conch template unpack`, resolve templates by immutable digest, and rely on containerd for component snapshot creation. Keep native manifest validation so invalid pulled templates fail before unpack reports success. Assisted-by: Codex:GPT-5.6-sol Assisted-by: Claude Code:GLM-5.2 Signed-off-by: Yifan Zhao <stopire@gmail.com>	1 个月前
handler_sandbox_test.go	feat: integrate incremental sandbox checkpoints	1 个月前
handler_snapshot_test.go	refactor(runtime): remove user-facing namespace support Namespace-aware APIs exposed isolation, but state and runtime paths did not consistently enforce it. Sandbox, template, image, snapshot, and volume identifiers could therefore have conflicting scopes. Adopt a single runtime scope and make identifiers globally unique within the daemon. Remove namespace fields from APIs, state records, CLI flags, SDK payloads, configuration, and documentation. Route containerd access through the adapter's fixed internal scope. Keep sandbox uniqueness policy in the runtime service while BoltStore remains an upsert-only persistence layer. Return configuration parsing errors from client construction so namespace removal does not hide malformed YAML. This intentionally provides no migration for namespace-scoped state. Assisted-by: Codex:GPT-5.6-sol Signed-off-by: Yifan Zhao <stopire@gmail.com>	1 个月前
handler_test.go	feat(network): add configurable sandbox policies Sandboxes previously inherited unrestricted network behavior from warm network slots, with no API for per-sandbox ingress or egress controls. Slot reuse could also retain policy and conntrack state across sandbox assignments. Add typed allow and deny configuration across the daemon, runtime service, persistent state, and Python SDK. Validate destinations before slot allocation and apply live changes with batched iptables updates. Compensate persistent state when updates fail, and clear policy and conntrack state before returning slots to the warm pool. Co-authored-by: Yifan Zhao <stopire@gmail.com> Assisted-by: Codex:GPT-5.6-sol Signed-off-by: Yifan Zhao <stopire@gmail.com>	1 个月前
request_decode_test.go	refactor(image): move boot index unpack to templates Image commands exposed archive transfer and unpacking for both OCI images and Conch Boot Indexes, although only template workflows need explicit unpacking. This blurred ownership and retained snapshot metadata and recovery behavior that the runtime no longer uses. Remove archive transfer and OCI image unpack APIs. Move explicit Boot Index unpacking to `conch template unpack`, resolve templates by immutable digest, and rely on containerd for component snapshot creation. Keep native manifest validation so invalid pulled templates fail before unpack reports success. Assisted-by: Codex:GPT-5.6-sol Assisted-by: Claude Code:GLM-5.2 Signed-off-by: Yifan Zhao <stopire@gmail.com>	1 个月前
types.go	feat(network): add configurable sandbox policies Sandboxes previously inherited unrestricted network behavior from warm network slots, with no API for per-sandbox ingress or egress controls. Slot reuse could also retain policy and conntrack state across sandbox assignments. Add typed allow and deny configuration across the daemon, runtime service, persistent state, and Python SDK. Validate destinations before slot allocation and apply live changes with batched iptables updates. Compensate persistent state when updates fail, and clear policy and conntrack state before returning slots to the warm pool. Co-authored-by: Yifan Zhao <stopire@gmail.com> Assisted-by: Codex:GPT-5.6-sol Signed-off-by: Yifan Zhao <stopire@gmail.com>	1 个月前