makearmy/le-app
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

add Phase 2B contained runtime artifacts

Browse source
This commit is contained in:
makearmy 2026-07-12 21:01:17 -04:00
parent a9fec0d83d
commit 82e64cec43
35 changed files with 5177 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

28
docs/le-app-database-migration/phase2b-contained-runtime/tests/00-read-only-preflight.sh Normal file
View file

@ -0,0 +1,28 @@
#!/bin/sh
set -eu
test "$(id -u)" -eq 0
test "$(docker version --format '{{.Server.Version}}')" = 29.6.1
test "$(sha256sum payload/usr/local/libexec/dockerd-rootless-29.6.1.sh | cut -d' ' -f1)" = 904c9b9e35f6927c0a5e65afb4d35b6bc9eb1278c878044501281fc728c9be46
test ! -S /run/user/1200/docker.sock
test "$(systemctl show user@1200.service -p ActiveState --value)" = inactive
test ! -e /var/lib/systemd/linger/le_app_codex
test -z "$(pgrep -u 1200 || true)"
test ! -e /run/netns/le-app-codex
test ! -e /etc/systemd/system/user@1200.service.d/50-le-app-codex-containment.conf
test ! -e /etc/systemd/system/user-1200.slice.d/50-le-app-codex-resources.conf
docker network inspect $(docker network ls -q) --format '{{.Name}} {{range .IPAM.Config}}{{.Subnet}} {{end}}'
ip -brief address
ip -4 route show table all
ip -6 route show table all
sed -n '1,120p' /etc/resolv.conf
nft --numeric list ruleset
systemctl cat user@1200.service
loginctl show-user 1200 || true
namei -om /srv/le-app-codex
find /srv/le-app-codex -xdev -printf '%M %u:%g %p\n'
getfacl -R -p /srv/le-app-codex
findmnt -R /srv/le-app-codex
grep -q 'elements = { 9\.9\.9\.9, 149\.112\.112\.112 }' payload/etc/nftables.d/50-le-app-codex.nft
grep -q 'elements = { 74\.67\.173\.56 }' payload/etc/nftables.d/50-le-app-codex.nft
grep -q '^nameserver 9\.9\.9\.9$' payload/etc/le-app-codex-runtime/resolv.conf
grep -q '^nameserver 149\.112\.112\.112$' payload/etc/le-app-codex-runtime/resolv.conf