sandlock-oci: single-sandbox OCI exec via sandlock-init#110

Merged

congwang-mk merged 14 commits into

mainfrom

Jun 24, 2026

Commits on Jun 22, 2026

sandlock-core: launch the confined process from an fd via execveat
congwang-mk
committed
sandlock-init: add crate skeleton and daemon control protocol
congwang-mk
committed
sandlock-init: implement the fork-exec control loop
congwang-mk
committed
sandlock-core: allow AT_EMPTY_PATH execveat under chroot
congwang-mk
committed
sandlock-init: use a separate exec pathname buffer to protect argv[0]
congwang-mk
committed
sandlock-oci: launch sandlock-init from a memfd and relay OCI verbs
congwang-mk
committed
sandlock-core: require empty pathname for AT_EMPTY_PATH execveat passthrough
congwang-mk
committed
sandlock-oci: wire exec CLI to the sandlock-init relay
congwang-mk
committed
sandlock-oci: add end-to-end single-sandbox exec test
congwang-mk
committed
sandlock-oci: document single-sandbox exec via sandlock-init
congwang-mk
committed
sandlock-oci: checkpoint the workload, not sandlock-init
congwang-mk
committed

Commits on Jun 23, 2026