mirror of
https://github.com/criyle/go-sandbox.git
synced 2025-09-26 23:19:11 +08:00
parent
10235abbf2
commit
2ba894ffd1
11
README.md
11
README.md
@ -13,8 +13,9 @@ Notice: Only works on Linux since ptrace, unshare, cgroup are available only on
|
||||
## Build & Install
|
||||
|
||||
- install latest go compiler from [golang/download](https://golang.org/dl/)
|
||||
- install libseccomp library: (for Ubuntu) `apt install libseccomp-dev`
|
||||
- build & install: `go install github.com/criyle/go-sandbox/...`
|
||||
- download repository: `git clone githuc.com/criyle/go-sandbox`
|
||||
- build: `go build ./cmd/runprog`
|
||||
- or install directly: `go install github.com/criyle/go-sandbox/cmd/runprog@latest`
|
||||
|
||||
## Technologies
|
||||
|
||||
@ -45,6 +46,12 @@ Default file access syscall check:
|
||||
2. Use Linux Control Groups to limit & acct CPU & memory (eliminated wait4.rusage)
|
||||
3. Container tech with execveat memfd, sethostname, setdomainname
|
||||
|
||||
### prefork containers
|
||||
|
||||
Utilize the linux namespace + cgroup but create container in advance to reduce the duplicated effort of creating mount points. See Pre-forked container protocol and environment for design details.
|
||||
|
||||
On kernel >= 5.7 with cgroup v2, the new `clone3(CLONE_INTO_CGROUP)` with `vfork` is available to reduce the resource consumption of create new address spaces as well.
|
||||
|
||||
## Design
|
||||
|
||||
### Result Status
|
||||
|
@ -4,6 +4,10 @@
|
||||
|
||||
#include "textflag.h"
|
||||
|
||||
// See ../runtime/sys_linux_386.s for the reason why we always use int 0x80
|
||||
// instead of the glibc-specific "CALL 0x10(GS)".
|
||||
#define INVOKE_SYSCALL INT $0x80
|
||||
|
||||
// func RawVforkSyscall(trap, a1, a2, a3 uintptr) (r1, err uintptr)
|
||||
TEXT ·RawVforkSyscall(SB),NOSPLIT|NOFRAME,$0-24
|
||||
MOVL trap+0(FP), AX // syscall entry
|
||||
|
Loading…
Reference in New Issue
Block a user