| update README.md | 7 个月前 |
| netstack: refill warm pool at a configurable threshold Add a configurable refill threshold that defaults to half the warm-pool capacity. Defer refill requests while sufficient warm slots remain, then refill the pool to its configured target once the threshold is reached. Wire and validate the setting, document its behavior, and update focused configuration and pool tests. Fixes issue #213: https://github.com/ConchSandbox/Conch/issues/213 | 2 天前 |
| sandbox: enforce configured memory admission with atomic accounting Track memory reserved by creating and active sandboxes in a single atomic counter so concurrent requests cannot exceed the effective limit. Retain each reservation until creation fails or the associated VMM is confirmed stopped, then release it exactly once. Update configuration, documentation, and focused tests for the new accounting contract. Fix issue #203: https://github.com/ConchSandbox/Conch/issues/203 | 4 天前 |
| docs(security): add the security model and deployment prerequisites Describe the trust boundary, the prerequisites a deployment has to meet and the existing behaviours deployers need to know about. conchd now creates work_dir with 0750: the volume bind mounts under it are a second path to shared host directories, one whose ancestors no longer include the restrictive parents of the source path. Fixes: https://github.com/ConchSandbox/Conch/issues/98 Assisted-by: Claude Code:claude-opus-5 Signed-off-by: wangzicheng <wangzicheng15@huawei.com> | 15 天前 |