feat(zhulan): add restricted remote development cell

server-tools/zhulan-remote-cell/tests/test_deployment_contract.py

@@ -0,0 +1,59 @@
+import unittest
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+class DeploymentContractTest(unittest.TestCase):
+    def test_runtime_upgrade_restarts_service(self):
+        installer = (ROOT / "deploy" / "install-runtime.sh").read_text(encoding="utf-8")
+        self.assertIn("systemctl enable zhulan-remote-cell.service", installer)
+        self.assertIn("systemctl restart zhulan-remote-cell.service", installer)
+        self.assertIn("systemctl restart zhulan-validation-executor.service", installer)
+        self.assertNotIn("systemctl enable --now zhulan-remote-cell.service", installer)
+
+    def test_bwrap_exception_is_scoped_to_runtime_copy(self):
+        env = (ROOT / "deploy" / "zhulan-remote-cell.env.example").read_text(encoding="utf-8")
+        profile = (ROOT / "deploy" / "zhulan-bwrap.apparmor").read_text(encoding="utf-8")
+        installer = (ROOT / "deploy" / "install-runtime.sh").read_text(encoding="utf-8")
+        private_copy = "/opt/guanghu/zhulan-remote-cell/runtime/zhulan-bwrap"
+        self.assertIn(f"ZHULAN_BWRAP={private_copy}", env)
+        self.assertIn(f"profile zhulan-remote-cell-bwrap {private_copy}", profile)
+        self.assertIn("  userns,", profile)
+        self.assertIn('install -o root -g zhulan-runtime -m 0750 /usr/bin/bwrap', installer)
+        self.assertNotIn("kernel.apparmor_restrict_unprivileged_userns=0", installer)
+        self.assertNotIn("chmod 4755", installer)
+
+    def test_only_executor_allows_bwrap_required_netlink_addition(self):
+        service = (ROOT / "deploy" / "zhulan-remote-cell.service").read_text(encoding="utf-8")
+        executor = (ROOT / "deploy" / "zhulan-validation-executor.service").read_text(encoding="utf-8")
+        self.assertIn(
+            "RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6",
+            service,
+        )
+        self.assertNotIn("AF_NETLINK", service)
+        self.assertIn("RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK", executor)
+        self.assertIn("RestrictNamespaces=user mnt pid net ipc uts", service)
+
+    def test_public_runtime_keeps_no_new_privileges_and_uses_local_executor(self):
+        public_service = (ROOT / "deploy" / "zhulan-remote-cell.service").read_text(encoding="utf-8")
+        executor_service = (ROOT / "deploy" / "zhulan-validation-executor.service").read_text(encoding="utf-8")
+        runtime = (ROOT / "runtime" / "zhulan_cell.py").read_text(encoding="utf-8")
+        self.assertIn("NoNewPrivileges=true", public_service)
+        self.assertIn("ProtectKernelTunables=true", public_service)
+        self.assertIn("Requires=zhulan-validation-executor.service", public_service)
+        self.assertNotIn("NoNewPrivileges=true", executor_service)
+        self.assertNotIn("ProtectKernelTunables=true", executor_service)
+        self.assertIn("RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK", executor_service)
+        self.assertIn("ReadOnlyPaths=/srv/guanghu/zhulan-cell/workspaces", executor_service)
+        self.assertIn("PrivateNetwork=true", executor_service)
+        self.assertIn("InaccessiblePaths=/etc/guanghu/secrets", executor_service)
+        self.assertIn("ReadOnlyPaths=/var/lib/guanghu/zhulan-remote-cell", executor_service)
+        self.assertIn("InaccessiblePaths=/srv/guanghu/zhulan-cell/candidates", executor_service)
+        self.assertIn("socket.AF_UNIX", runtime)
+        self.assertNotIn('argv = [\n                    str(self.settings.bwrap_path)', runtime)
+
+
+if __name__ == "__main__":
+    unittest.main()