mirror of
https://github.com/nestriness/nestri.git
synced 2026-11-03 22:22:39 +02:00
DatCaptainHorseandClaude Sonnet 5.5
d0ec87a139
The host can now ask a box for a shell on a pseudo-terminal, the way a container runtime attaches to a container. `HostToGuest::Attach` starts the process, and the guest then dials the host on a vsock port of its own (7001) and carries the terminal's bytes over a small framed stream: data both ways, a resize, a hangup, and the exit status last. A screenful of output on the JSON-lines control channel would hold every other message in the box behind it, which is why it is not there. A failure to start is the exception, and is said on the control channel because nothing has connected to the data port yet. A shell is not a launch: it never ends the box, and the box ending ends it. It is started through the same reaper as everything else, so it cannot become the zombie that exists to be prevented. With a terminal on the other end the PTY is ordinary; without one it is put in raw mode so a command run for its output gets its bytes back unrewritten. Closing the stream hangs the shell up, process group and all. The frame codec is a pure bytes-in, frames-out module in nesprotocol with a payload cap and no skipping of unknown tags, since a length read from a guest is read across a trust boundary. No version bump: adding a message does not need one, and a guest that predates it simply never dials. The runtime stage gains strace, lsof and less, so a root shell in a box is not one that cannot trace a process. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>