Skip to content

Add a container primitive built on namespaces and cgroups v2 #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
erichanwang wants to merge 6 commits into
base: main
Choose a base branch
from
Open

Add a container primitive built on namespaces and cgroups v2 #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
2ac3c2a
Add a container primitive built on namespaces and cgroups v2
erichanwang Jul 23, 2026
2e4080a
Pin build inputs, fix a broken bootstrap, and guard the air gap
erichanwang Jul 28, 2026
45d511d
Fix neuros-verify --json/--quiet suppression and the tests that mis-s…
erichanwang Jul 30, 2026
09a5c36
Wire all test files into CI and close remaining air-gap guard gaps
erichanwang Jul 30, 2026
ff051c9
Pin the remaining floating build inputs: Docker base image, CI action…
erichanwang Aug 5, 2026
a8ab405
Add policy, replay, runbook, sandbox primitives with tests
erichanwang Aug 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 44 additions & 8 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ jobs:
name: Validate Build Configuration
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

- name: Make scripts executable
run: |
Expand All @@ -24,7 +24,10 @@ jobs:
run: bash validate-build.sh

- name: Run unit tests
run: python3 tests/test_nn.py -v
run: python3 -m unittest discover -s tests -p 'test_*.py' -v

- name: Air-gap check (no new outbound network calls)
run: bash scripts/check-airgap.sh

- name: Check shell script syntax
run: |
Expand All @@ -38,7 +41,7 @@ jobs:
name: Lint & Format Check
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

- name: Check all Python files compile
run: |
Expand Down Expand Up @@ -72,11 +75,11 @@ jobs:
done

build-iso:
name: Build ISO (Structure Check)
name: Build ISO (Structure + lb config + package resolution)
runs-on: ubuntu-24.04
needs: validate
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

- name: Install dependencies
run: |
Expand All @@ -91,17 +94,50 @@ jobs:
test -d config/package-lists && echo "OK: package lists present"
test -f build.sh && echo "OK: build.sh present"
test -f validate-build.sh && echo "OK: validate-build.sh present"
echo "Structure OK — full ISO build requires 20GB disk (CI runners limited)"
echo "Structure OK — a full ISO build (debootstrap + chroot + squashfs)"
echo "needs 20GB+ disk and privileged mounts CI runners don't have."

- name: Run lb config with the pinned snapshot mirror
run: |
SNAPSHOT_TS=$(grep -oP '(?<=SNAPSHOT_TS=")[^"]+' build.sh)
SNAPSHOT_MIRROR="https://snapshot.ubuntu.com/ubuntu/${SNAPSHOT_TS}"
echo "Pinned snapshot: $SNAPSHOT_MIRROR"
lb config \
--mode ubuntu \
--distribution noble \
--archive-areas "main restricted universe multiverse" \
--debian-installer none \
--memtest none \
--binary-images iso-hybrid \
--mirror-bootstrap "$SNAPSHOT_MIRROR" \
--mirror-chroot "$SNAPSHOT_MIRROR" \
--mirror-chroot-security "$SNAPSHOT_MIRROR"
echo "OK: lb config succeeded against the pinned snapshot"

- name: Resolve neuros.list.chroot against the pinned snapshot
run: |
SNAPSHOT_TS=$(grep -oP '(?<=SNAPSHOT_TS=")[^"]+' build.sh)
SNAPSHOT_MIRROR="https://snapshot.ubuntu.com/ubuntu/${SNAPSHOT_TS}"
sudo tee /etc/apt/sources.list.d/neuros-snapshot.list > /dev/null <<SRC
deb $SNAPSHOT_MIRROR noble main restricted universe multiverse
deb $SNAPSHOT_MIRROR noble-updates main restricted universe multiverse
deb $SNAPSHOT_MIRROR noble-backports main restricted universe multiverse
deb $SNAPSHOT_MIRROR noble-security main restricted universe multiverse
SRC
sudo apt-get update
PACKAGES=$(grep -vE '^\s*(#|$)' config/package-lists/neuros.list.chroot | tr '\n' ' ')
echo "Packages: $PACKAGES"
sudo apt-get install --dry-run -y $PACKAGES

docker-build:
name: Docker Container Build
runs-on: ubuntu-24.04
needs: validate
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

- name: Build Docker image
run: docker build -t neuros-build . 2>&1 || echo "Docker build skipped (non-critical in CI)"
Expand Down
10 changes: 7 additions & 3 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,10 @@
# Or use with docker-compose:
# docker compose up

FROM ubuntu:24.04
# Pinned to a digest instead of the floating 24.04 tag, which Canonical
# rebuilds in place for security updates -- the digest is immutable, so the
# build container's starting filesystem can't drift between builds.
FROM ubuntu:24.04@sha256:561618e2c15bf2397621dd04f96926663a3b5616c189cf7e38db7e82f5c538ea

ENV DEBIAN_FRONTEND=noninteractive
ENV TZ=UTC
Expand Down Expand Up @@ -48,8 +51,9 @@ COPY build.sh /opt/neuros/
COPY Makefile /opt/neuros/
COPY validate-build.sh /opt/neuros/

# Install Python dependencies
RUN pip3 install --break-system-packages requests || true
# Install Python dependencies (pinned so this doesn't silently pick up a
# newer requests on rebuild)
RUN pip3 install --break-system-packages requests==2.34.2 || true

# Set up neuros tools in container
RUN mkdir -p /usr/local/bin && \
Expand Down
Loading