fix/exec-umask 2cd66dc

history of internal/sandbox/vm/vm_test.go at fix/exec-umask

2026-10-13

ad47140feat(externals): provide pinned Node.js to sandboxes outside the image GPG Verifiedbrice
6699244feat(runner): opt-in guest access to the forge host:port of ERMITE_RUNNER_URL GPG Verifiedbrice

2026-10-12

579bcb3fix(vm): kill VMM processes through a pidfd after re-checking their identity GPG Verifiedbrice
b72d29ffix(vm): scope an unjailed Firecracker by its --api-sock GPG Verifiedbrice
25328fcfix(vm): identify the jailed VMM by its root inode, not readlink GPG Verifiedbrice
982af7cfix(vm): refuse an unsafe jailer chroot base GPG Verifiedbrice
bbd315bfix(vm): check every socket path against sun_path, in both jailer modes GPG Verifiedbrice
7ddb5dafix(vm): scope the VMM scan to our jail base; share the marker set GPG Verifiedbrice
2bb0741fix(vm): recognise the Firecracker the jailer execs into its chroot GPG Verifiedbrice
ea344adfix(vm): refuse a state directory whose jailed API socket path exceeds sun_path GPG Verifiedbrice
ed21f4ffix(vm): create the jailer chroot base directory GPG Verifiedbrice
6be4205chore(build): consistent image tag, exact kernel option matching, e2fsprogs check, CI proto drift check; docs for the new limits, host lock and ip_forward GPG Verifiedbrice
146655afix(sandbox/container): host lock, deny-privileged and per-job warning, pids and swap limits, loop-mounted scratch disk, keep policy while the container may run, abortable boot, ErrLeaked GPG Verifiedbrice
2f75a56fix(sandbox/vm): jailer cgroup v2 limits and PID namespace, rate limiters, keep network while the VMM may run, abortable boot, reap by --id, Lchown/fchown GPG Verifiedbrice
8784b11fix(guest): escalate cancellation SIGINT/SIGTERM/SIGKILL, stream through frame writers, forward init signals; cancel channel in Drive GPG Verifiedbrice
82488a8feat(sandbox/vm): add the Firecracker micro-VM driver with jailer, TAP and crash reaping GPG Verifiedbrice

Keyboard shortcuts

Single-key shortcuts are on. ctrl k and esc work whatever this says.

ctrl k :
go to a section, branch, tag, file or repository
?
this list
j k
move the row cursor down / up
enter
open the row under the cursor; on Files, a directory opens or closes in place
↑ ↓ ← → home end
in the file tree (focus on a row): previous / next row, close / open a directory or go to its parent / first entry, first / last row. They never open a file
l h
on Files: open a directory or a file / close a directory or go up to its parent, then to the parent page. Elsewhere: into the side panel (on a merge request, its files) / back to the content; there j k move between its controls
g g G
first / last row
/
filter the list; on Files, find a file anywhere in the repository (esc clears, enter opens the best match)
b
switch branch or tag
g s g f g c g b g m g i g r g a
tabs: summary, files, commits, branches & tags, merge requests, issues, releases, actions (when available)
g h
home
w
wide mode: use the whole width of the screen, or not (remembered)
y
copy a permalink pinned to the commit
d u x
diff: split / unified / collapse or expand all
e E
diff: the whole file in view / every file, with the lines the hunks hide
n
merge request: next note in the diff
esc
close a dialog, leave a field

Branches 4

Tags 11

↑↓ moveenter openesc close