| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
refactor(sandbox): centralize lifecycle management Move sandbox state, leases, rollback, and lifecycle events into Manager. Keep template selection and registration in Service, and remove duplicate startup content validation. Consolidate boot specifications, cold and restore launch paths, and Manager tests. Preserve cleanup progress for retries after partial failures. Validation: go test ./... passed; root-only integration tests skipped. | 1 个月前 | |
fix(guestd): preserve rootfs layer precedence guestd prepended every discovered pmem mount while building OverlayFS lowerdir. OverlayFS gives the leftmost lower layer precedence, so an older layer could mask later image changes to existing files such as /etc/passwd. As a result, users created by later Dockerfile layers were absent from the running sandbox. Keep the VMM-assigned pmem order when constructing lowerdir so pmem0, which carries the newest rootfs layer, has highest precedence. Sort device names by their numeric suffix before mounting because filepath.Glob orders pmem10 before pmem2 lexically, which would otherwise corrupt precedence for images with more than nine layers. Add focused coverage for numeric ordering and exclusion of pmem partition or malformed device names. | 1 个月前 | |
api: bound request and file operation resources Assisted-by: Codex:GPT-5.6-sol Signed-off-by: Yifan Zhao <stopire@gmail.com> | 2 个月前 | |
[diagnostics]: trace shutdown and cleanup stages | 4 个月前 | |
fix(#193): report invalid client inputs | 1 个月前 | |
refactor(sandbox): centralize lifecycle management Move sandbox state, leases, rollback, and lifecycle events into Manager. Keep template selection and registration in Service, and remove duplicate startup content validation. Consolidate boot specifications, cold and restore launch paths, and Manager tests. Preserve cleanup progress for retries after partial failures. Validation: go test ./... passed; root-only integration tests skipped. | 1 个月前 | |
sandbox: enforce configured memory admission with atomic accounting Track memory reserved by creating and active sandboxes in a single atomic counter so concurrent requests cannot exceed the effective limit. Retain each reservation until creation fails or the associated VMM is confirmed stopped, then release it exactly once. Update configuration, documentation, and focused tests for the new accounting contract. Fix issue #203: https://github.com/ConchSandbox/Conch/issues/203 | 1 个月前 | |
sandbox: enforce configured memory admission with atomic accounting Track memory reserved by creating and active sandboxes in a single atomic counter so concurrent requests cannot exceed the effective limit. Retain each reservation until creation fails or the associated VMM is confirmed stopped, then release it exactly once. Update configuration, documentation, and focused tests for the new accounting contract. Fix issue #203: https://github.com/ConchSandbox/Conch/issues/203 | 1 个月前 | |
feat(webhook): add sandbox lifecycle notifications Add in-memory Webhook management and asynchronous lifecycle delivery for sandbox creation, requested deletion, and unexpected runtime exits. Keep sandbox records as UNKNOWN after unexpected exits and publish orphaned lifecycle events. Assisted-by: Codex:GPT-5.6-sol Signed-off-by: hu-zhangying <huzhangying@huawei.com> | 2 个月前 | |
| 1 个月前 | ||
refactor(sandbox): make resource cleanup explicit and idempotent | 1 个月前 | |
sandbox: transfer runtime ownership to sandbox records | 1 个月前 | |
sandbox: enforce configured memory admission with atomic accounting Track memory reserved by creating and active sandboxes in a single atomic counter so concurrent requests cannot exceed the effective limit. Retain each reservation until creation fails or the associated VMM is confirmed stopped, then release it exactly once. Update configuration, documentation, and focused tests for the new accounting contract. Fix issue #203: https://github.com/ConchSandbox/Conch/issues/203 | 1 个月前 | |
refactor(sandbox): make resource cleanup explicit and idempotent | 1 个月前 | |
refactor(sandbox): centralize lifecycle management Move sandbox state, leases, rollback, and lifecycle events into Manager. Keep template selection and registration in Service, and remove duplicate startup content validation. Consolidate boot specifications, cold and restore launch paths, and Manager tests. Preserve cleanup progress for retries after partial failures. Validation: go test ./... passed; root-only integration tests skipped. | 1 个月前 | |
docs(security): add the security model and deployment prerequisites Describe the trust boundary, the prerequisites a deployment has to meet and the existing behaviours deployers need to know about. conchd now creates work_dir with 0750: the volume bind mounts under it are a second path to shared host directories, one whose ancestors no longer include the restrictive parents of the source path. Fixes: https://github.com/ConchSandbox/Conch/issues/98 Assisted-by: Claude Code:claude-opus-5 Signed-off-by: wangzicheng <wangzicheng15@huawei.com> | 1 个月前 | |
cli: add --version support usage example: root@localhost:~# conch --version conch version v0.0.1, build v0.0.1-dae2fc05 root@localhost:~# conchd --version conch version v0.0.1, build v0.0.1-dae2fc05 Signed-off-by: jingrui <jingrui@huawei.com> | 3 个月前 | |
refactor(sandbox): make resource cleanup explicit and idempotent | 1 个月前 | |
refactor(sandbox): make resource cleanup explicit and idempotent | 1 个月前 | |
feat(webhook): add sandbox lifecycle notifications Add in-memory Webhook management and asynchronous lifecycle delivery for sandbox creation, requested deletion, and unexpected runtime exits. Keep sandbox records as UNKNOWN after unexpected exits and publish orphaned lifecycle events. Assisted-by: Codex:GPT-5.6-sol Signed-off-by: hu-zhangying <huzhangying@huawei.com> | 2 个月前 |