Re: [PATCH v3 2/5] host/rootfs: Sandbox router

Yureka
2025-12-03T16:06:12Z

On 12/3/25 16:54, Demi Marie Obenour wrote:
> This needs very little access to the system.
>
> Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
> ---
> .../template/data/service/spectrum-router/run | 19 ++++++++++++++++---
> 1 file changed, 16 insertions(+), 3 deletions(-)
>
> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
> index 7b3e3db3b109ba1c8d195c7c47d50d0cfbc30bd5..ef68cd638c092b53cc714a5d65bbfa3b49585346 100755
> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
> @@ -4,6 +4,19 @@
>
> importas -i VM VM
>
> -export RUST_LOG spectrum-router=debug,info
> -spectrum-router --app-listen-path ${VM}/router-app.sock --driver-listen-path ${VM}/router-driver.sock
> -
> +bwrap
> + --unshare-all
> + --unshare-user
> + --dev-bind / /
> + --setenv RUST_LOG spectrum-router=debug,info
> + --tmpfs /tmp
> + --dev /dev
> + --tmpfs /dev/shm
> + --ro-bind /nix /nix
> + --ro-bind /etc /etc
> + --tmpfs /run
This won't work. The router sets up unix sockets in /run which are
accessed by the vmm.
> + --ro-bind /usr /usr
> + --ro-bind /lib /lib
> + --bind $VM $VM
> + --
> + spectrum-router --app-listen-path ${VM}/router-app.sock --driver-listen-path ${VM}/router-driver.sock
>
Please make sure the integration tests still pass after this.