nordisk/edda

crates/nornir-build-thing/tests/fixtures/heimdall-kernel-runtime-needs.json

{
  "schema": "nornir.kernel-runtime-needs/1",
  "producer": "heimdall 0.3.1",
  "mode": "strict",
  "needs": [
    {
      "symbol": "CONFIG_SECCOMP",
      "value": "y",
      "op": "set",
      "needed_by": "strict",
      "feature": "seccomp_filter",
      "reason": "Heimdall strict: every job runs under a seccomp filter (SECCOMP_RET_KILL_PROCESS); without it the runner refuses to start"
    },
    {
      "symbol": "CONFIG_SECCOMP_FILTER",
      "value": "y",
      "op": "set",
      "needed_by": "strict",
      "feature": "seccomp_filter",
      "reason": "Heimdall strict: the job's profile is a BPF filter (SECCOMP_SET_MODE_FILTER), and the broker's USER_NOTIF listener hangs off it"
    },
    {
      "symbol": "CONFIG_MULTIUSER",
      "value": "y",
      "op": "set",
      "needed_by": "strict",
      "feature": "landlock",
      "reason": "Heimdall strict: SECURITY and NAMESPACES depend on MULTIUSER (security/Kconfig, init/Kconfig)"
    },
    {
      "symbol": "CONFIG_SECURITY",
      "value": "y",
      "op": "set",
      "needed_by": "strict",
      "feature": "landlock",
      "reason": "Heimdall strict: the LSM menu Landlock hangs off (security/Kconfig)"
    },
    {
      "symbol": "CONFIG_SECURITY_LANDLOCK",
      "value": "y",
      "op": "set",
      "needed_by": "strict",
      "feature": "landlock",
      "reason": "Heimdall strict: every job is restricted with Landlock (filesystem and network rules no root inside the job can widen); without it the runner refuses to start"
    },
    {
      "symbol": "CONFIG_LSM",
      "value": "landlock",
      "op": "list_contains",
      "needed_by": "strict",
      "feature": "landlock",
      "reason": "Heimdall strict: Landlock must be in the LSM boot order by name (`landlock` in CONFIG_LSM or lsm=), or the kernel has it built and never starts it"
    },
    {
      "symbol": "CONFIG_CGROUPS",
      "value": "y",
      "op": "set",
      "needed_by": "strict",
      "feature": "cgroup_v2",
      "reason": "Heimdall strict: every job's limits are a cgroup v2 cgroup under the runner's parent"
    },
    {
      "symbol": "CONFIG_MEMCG",
      "value": "y",
      "op": "set",
      "needed_by": "strict",
      "feature": "cgroup.memory",
      "reason": "Heimdall strict: memory.max and memory.swap.max, the job's memory limit"
    },
    {
      "symbol": "CONFIG_CGROUP_PIDS",
      "value": "y",
      "op": "set",
      "needed_by": "strict",
      "feature": "cgroup.pids",
      "reason": "Heimdall strict: pids.max, the job's process limit (a fork bomb ends there)"
    },
    {
      "symbol": "CONFIG_CGROUP_SCHED",
      "value": "y",
      "op": "set",
      "needed_by": "strict",
      "feature": "cgroup.cpu",
      "reason": "Heimdall strict: the cpu controller cpu.max hangs off"
    },
    {
      "symbol": "CONFIG_FAIR_GROUP_SCHED",
      "value": "y",
      "op": "set",
      "needed_by": "strict",
      "feature": "cgroup.cpu",
      "reason": "Heimdall strict: the CFS group the job's cpu quota is accounted on"
    },
    {
      "symbol": "CONFIG_CFS_BANDWIDTH",
      "value": "y",
      "op": "set",
      "needed_by": "strict",
      "feature": "cgroup.cpu",
      "reason": "Heimdall strict: cpu.max, the job's cpu quota"
    },
    {
      "symbol": "CONFIG_NAMESPACES",
      "value": "y",
      "op": "set",
      "needed_by": "strict",
      "feature": "user_namespaces",
      "reason": "Heimdall strict: every job is a container in its own namespaces"
    },
    {
      "symbol": "CONFIG_USER_NS",
      "value": "y",
      "op": "set",
      "needed_by": "strict",
      "feature": "user_namespaces",
      "reason": "Heimdall strict: the job's root maps to one unprivileged host id; without user namespaces the runner refuses to start"
    },
    {
      "symbol": "CONFIG_PID_NS",
      "value": "y",
      "op": "set",
      "needed_by": "job",
      "feature": "job.namespaces",
      "reason": "every job's container has its own pid namespace (heimdall-plain spec.rs): it sees only itself, a kill reaches all of it"
    },
    {
      "symbol": "CONFIG_SYSVIPC",
      "value": "y",
      "op": "set",
      "needed_by": "job",
      "feature": "job.namespaces",
      "reason": "IPC_NS depends on SYSVIPC or POSIX_MQUEUE (init/Kconfig)"
    },
    {
      "symbol": "CONFIG_IPC_NS",
      "value": "y",
      "op": "set",
      "needed_by": "job",
      "feature": "job.namespaces",
      "reason": "every job's container has its own ipc namespace (heimdall-plain spec.rs)"
    },
    {
      "symbol": "CONFIG_UTS_NS",
      "value": "y",
      "op": "set",
      "needed_by": "job",
      "feature": "job.namespaces",
      "reason": "every job's container has its own uts namespace (heimdall-plain spec.rs)"
    },
    {
      "symbol": "CONFIG_NET",
      "value": "y",
      "op": "set",
      "needed_by": "job",
      "feature": "job.namespaces",
      "reason": "NET_NS depends on NET (net/Kconfig)"
    },
    {
      "symbol": "CONFIG_NET_NS",
      "value": "y",
      "op": "set",
      "needed_by": "job",
      "feature": "job.namespaces",
      "reason": "every job's container has its own, empty network namespace (heimdall-plain spec.rs)"
    },
    {
      "symbol": "CONFIG_TMPFS",
      "value": "y",
      "op": "set",
      "needed_by": "job",
      "feature": "job.mounts",
      "reason": "every job's /tmp is a capped tmpfs (heimdall-plain spec.rs)"
    },
    {
      "symbol": "CONFIG_CROSS_MEMORY_ATTACH",
      "value": "y",
      "op": "set",
      "needed_by": "broker",
      "feature": "broker.read_args",
      "reason": "the broker reads a job's call arguments with process_vm_readv(2) (heimdall-broker sys.rs); tinyconfig leaves it off"
    }
  ]
}