bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

fix: allow verified JD Ubuntu proxy digest

Browse source
This commit is contained in:
冰朔 2026-08-15 17:53:33 +08:00
commit e832dc6ad7
3 changed files with 18 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

5
product-source/hololake-platform/guanghu-os/README.md
View file

@ -80,7 +80,10 @@ physical cutover is implied by that source result.
`scripts/linux-subcontrol-docker-backend.sh` is the first executable shadow `scripts/linux-subcontrol-docker-backend.sh` is the first executable shadow
backend for the Linux-hosted transition. It binds the exact JD instance, backend for the Linux-hosted transition. It binds the exact JD instance,
backend id, immutable Ubuntu image digest, and preserved GRUB rescue slot. A backend id, immutable Ubuntu image digest, and preserved GRUB rescue slot. It
accepts only the direct Ubuntu repository or the explicitly approved
`docker.m.daocloud.io/library/ubuntu` proxy needed by the JD route; arbitrary
registry paths fail closed. A
wake starts a networkless, read-only, capability-free container with explicit wake starts a networkless, read-only, capability-free container with explicit
CPU, memory, and PID limits. Only the registered runtime-identity readback is CPU, memory, and PID limits. Only the registered runtime-identity readback is
accepted; reclaim removes the container and verifies `DORMANT`. Environment accepted; reclaim removes the container and verifies `DORMANT`. Environment

2
product-source/hololake-platform/guanghu-os/scripts/linux-subcontrol-docker-backend.sh
View file

@ -55,7 +55,7 @@ done <"${config_path}"
[[ "${instance_id}" =~ ^[0-9a-f-]{36}$ ]] || die "instance id is invalid" [[ "${instance_id}" =~ ^[0-9a-f-]{36}$ ]] || die "instance id is invalid"
[[ "${backend_id}" =~ ^[a-z0-9-]+$ ]] || die "backend id is invalid" [[ "${backend_id}" =~ ^[a-z0-9-]+$ ]] || die "backend id is invalid"
[[ "${container_name}" =~ ^[a-z0-9-]+$ ]] || die "container name is invalid" [[ "${container_name}" =~ ^[a-z0-9-]+$ ]] || die "container name is invalid"
[[ "${image}" =~ ^ubuntu@sha256:[0-9a-f]{64}$ ]] || die "image must use an immutable Ubuntu digest" [[ "${image}" =~ ^(ubuntu|docker\.m\.daocloud\.io/library/ubuntu)@sha256:[0-9a-f]{64}$ ]] || die "image must use an immutable Ubuntu digest from the direct or approved proxy repository"
[[ "${rescue_slot_id}" =~ ^[A-Za-z0-9._-]+$ ]] || die "rescue slot id is invalid" [[ "${rescue_slot_id}" =~ ^[A-Za-z0-9._-]+$ ]] || die "rescue slot id is invalid"
[[ -x "${docker_bin}" ]] || die "docker executable is unavailable" [[ -x "${docker_bin}" ]] || die "docker executable is unavailable"

15
product-source/hololake-platform/guanghu-os/scripts/test-linux-subcontrol-docker-backend.sh
View file

@ -15,7 +15,7 @@ node_id=JD-FD-PRIMARY
instance_id=f3d4b730-7f02-452f-975b-7091a4800431 instance_id=f3d4b730-7f02-452f-975b-7091a4800431
backend_id=jd-linux-on-demand backend_id=jd-linux-on-demand
container_name=guanghu-linux-subcontrol-jd container_name=guanghu-linux-subcontrol-jd
image=ubuntu@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa image=docker.m.daocloud.io/library/ubuntu@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
rescue_slot_id=gnulinux-simple-9e4550a0-452b-4f28-b5a5-d5364aa450f6 rescue_slot_id=gnulinux-simple-9e4550a0-452b-4f28-b5a5-d5364aa450f6
EOF EOF
@ -73,7 +73,18 @@ grep -Fq -- '--read-only' "${fixture}/docker.log"
grep -Fq -- '--cap-drop ALL' "${fixture}/docker.log" grep -Fq -- '--cap-drop ALL' "${fixture}/docker.log"
grep -Fq -- '--security-opt no-new-privileges' "${fixture}/docker.log" grep -Fq -- '--security-opt no-new-privileges' "${fixture}/docker.log"
grep -Fq -- '--pids-limit 64' "${fixture}/docker.log" grep -Fq -- '--pids-limit 64' "${fixture}/docker.log"
grep -Fq -- 'ubuntu@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' "${fixture}/docker.log" grep -Fq -- 'docker.m.daocloud.io/library/ubuntu@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' "${fixture}/docker.log"
sed -i.bak 's#docker.m.daocloud.io/library/ubuntu@#ubuntu@#' "${fixture}/backend.conf"
"${adapter}" preflight jd-linux-on-demand
mv "${fixture}/backend.conf.bak" "${fixture}/backend.conf"
sed -i.bak 's#docker.m.daocloud.io/library/ubuntu@#unapproved.example/ubuntu@#' "${fixture}/backend.conf"
if "${adapter}" preflight jd-linux-on-demand; then
echo "unapproved image repository was accepted" >&2
exit 1
fi
mv "${fixture}/backend.conf.bak" "${fixture}/backend.conf"
if "${adapter}" execute jd-linux-on-demand arbitrary-shell REQ-002; then if "${adapter}" execute jd-linux-on-demand arbitrary-shell REQ-002; then
echo "unregistered capability was accepted" >&2 echo "unregistered capability was accepted" >&2