diff --git a/CLAUDE.md b/CLAUDE.md index ff8aa24..87dc448 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -66,15 +66,15 @@ Source layout (all under `src/`): `executable()` target in `meson.build`, **built with `-static`**). Deliberately has zero dependencies on the rest of this project (no fmt/spdlog/etc.) and is fully statically linked: it gets bind-mounted *into the container image's own - filesystem*, which won't have `slocker_lite`'s own shared library dependencies — + filesystem*, which won't have `slocker-lite`'s own shared library dependencies — a dynamically linked binary bind-mounted that way fails outright ("error while loading shared libraries"), which is exactly what happened before this was split - out (the original approach bind-mounted `slocker_lite`'s own — dynamically linked + out (the original approach bind-mounted `slocker-lite`'s own — dynamically linked — binary via `/proc/self/exe` and reexeced it; kept only as a lesson, not as working code). Usage: `slocker-lite-priv-drop : -- [args...]`; does `setgroups(0,…)` → `setgid()` → `setuid()` → `execvp()`, in that order (dropping the group needs `CAP_SETGID`, which is lost once `setuid()` drops root). - `find_priv_drop_helper()` (`src/bwrap.cpp`) locates it next to `slocker_lite`'s own + `find_priv_drop_helper()` (`src/bwrap.cpp`) locates it next to `slocker-lite`'s own binary (via `/proc/self/exe`'s directory), which holds both when run straight from `buildDir/` and after a real `meson install`. - `user_spec.{h,cpp}` — `resolve_user_and_group()` resolves a user/group spec (each @@ -92,7 +92,7 @@ Source layout (all under `src/`): run). Also `find_in_path()`, a shared `$PATH` lookup. `run_process_foreground()` installs a SIGINT/SIGTERM handler around its `waitpid()` that forwards the signal to the running child and keeps waiting instead of letting the default disposition - kill `slocker_lite` itself — without this, Ctrl-C (or `kill`) during `-r`'s `bwrap` + kill `slocker-lite` itself — without this, Ctrl-C (or `kill`) during `-r`'s `bwrap` run would skip `run_container()`'s unmount/cleanup entirely, leaving the layer imported and/or mounted. @@ -125,7 +125,7 @@ Build directory is `buildDir/` (already configured). - Build: `meson compile -C buildDir` (or `ninja -C buildDir`) — also builds `buildDir/slocker-lite-priv-drop`, the statically-linked helper `-r --user` needs (see `priv_drop_helper.cpp` in "Project state") -- Run the executable: `./buildDir/slocker_lite -m ` (see `--help` for the +- Run the executable: `./buildDir/slocker-lite -m ` (see `--help` for the full flag list: `-m/--mount`, `-r/--run`, `-u/--umount`, `-c/--cleanup`, `-l/--list-images`, `-n/--no-nsenter`, `--user`, `--group`, `-t/--test`, `--log-level`, `-h/--help`, `-V/--version`) @@ -146,4 +146,4 @@ Build directory is `buildDir/` (already configured). ## Build configuration notes - `meson.build` sets `warning_level=3` and `cpp_std=c++20` — keep new code warning-clean under `-Wall -Wextra -Wpedantic`-equivalent settings. -- The single Meson `test()` target runs `slocker_lite` against a fixture OCI image tar generated at build time by `tests/gen_fixture.py` (a `custom_target`) and checks its exit code (no test framework is wired in yet). +- The single Meson `test()` target runs `slocker-lite` against a fixture OCI image tar generated at build time by `tests/gen_fixture.py` (a `custom_target`) and checks its exit code (no test framework is wired in yet). diff --git a/meson.build b/meson.build index 2060480..cb62f4f 100644 --- a/meson.build +++ b/meson.build @@ -16,7 +16,7 @@ conf_data.set10('ENABLE_TESTS', get_option('enable_tests')) configure_file(output : 'config.h', configuration : conf_data) -slocker_lite = executable('slocker_lite', +slocker_lite = executable('slocker-lite', ['src/main.cpp', 'src/process.cpp', 'src/oci_image.cpp', 'src/containers_storage.cpp', 'src/bwrap.cpp', 'src/user_spec.cpp'], include_directories : include_directories('.'), diff --git a/src/bwrap.cpp b/src/bwrap.cpp index db55458..63d9b98 100644 --- a/src/bwrap.cpp +++ b/src/bwrap.cpp @@ -40,16 +40,16 @@ namespace { // when dropping privileges to a --user/--group (see build_bwrap_args()). constexpr const char* kPrivDropPath = "/.slocker-lite-priv-drop"; -// Name of the statically-linked helper binary built alongside slocker_lite +// Name of the statically-linked helper binary built alongside slocker-lite // (src/priv_drop_helper.cpp) -- it has to be a separate, dependency-free static -// binary rather than slocker_lite's own binary, since bind-mounting a dynamically +// binary rather than slocker-lite's own binary, since bind-mounting a dynamically // linked executable into an arbitrary container image fails ("error while loading -// shared libraries") when that image's own /lib lacks slocker_lite's dependencies. +// shared libraries") when that image's own /lib lacks slocker-lite's dependencies. constexpr const char* kPrivDropHelperName = "slocker-lite-priv-drop"; // Locates the priv-drop helper installed next to this process's own binary (found // via /proc/self/exe), which holds whether run from buildDir/ or after a proper -// `meson install` -- both put slocker_lite and the helper in the same directory. +// `meson install` -- both put slocker-lite and the helper in the same directory. std::optional find_priv_drop_helper() { std::error_code ec; auto self_path = std::filesystem::read_symlink("/proc/self/exe", ec); diff --git a/src/priv_drop_helper.cpp b/src/priv_drop_helper.cpp index af12696..17ed612 100644 --- a/src/priv_drop_helper.cpp +++ b/src/priv_drop_helper.cpp @@ -19,7 +19,7 @@ // regardless of what libc/libraries that image does or doesn't have. Deliberately // avoids fmt/spdlog/anything else from the rest of this project -- a dynamically // linked binary bind-mounted into a container fails with "error while loading -// shared libraries", since the container's own /lib won't have slocker_lite's +// shared libraries", since the container's own /lib won't have slocker-lite's // dependencies. // // Usage: slocker-lite-priv-drop : -- [args...]