Documentation
¶
Overview ¶
Package deployment verifies the complete host-selected runsc installation. Matching bytes establish deployment identity, not isolation qualification.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Verify ¶
func Verify(ctx context.Context, directory string, manifest Manifest, ownerUID uint32) (string, error)
Verify checks a dedicated installation against a trusted manifest without executing it. All files and installation directories must belong to ownerUID; the production root-run worker must supply zero. Ancestors must belong to root or that owner and deny other writers, except root-owned sticky directories. Resolve any administrative path aliases before configuring the directory.
The trusted owner must keep the installation unchanged during verification and use. This is not a lock against that owner's later writes. Recheck before dispatch, and never allow workloads to write any part of the installation.
Types ¶
type File ¶
type File struct {
Path string `json:"path"`
SHA256 string `json:"sha256"`
Bytes int64 `json:"bytes"`
Mode uint32 `json:"mode"`
}
File pins one executable's relative path, content, size and Unix permissions. Sidecars must remain beside runsc under gvisor-bin. Links are not supported.
type Manifest ¶
type Manifest struct {
SchemaVersion int `json:"schema_version"`
Architecture string `json:"architecture"`
Files []File `json:"files"`
}
Manifest is trusted host configuration obtained from an approved release. Never derive the expected hashes from the installation being checked. The optional containerd shim and every installed sidecar must be inventoried.
Source Files