add Phase 2B contained runtime artifacts

docs/le-app-database-migration/phase2b-contained-runtime/tests/10-inert-containment.sh

@@ -0,0 +1,41 @@
+#!/bin/sh
+set -eu
+fail=0
+expect_denied() { if "$@" >/dev/null 2>&1; then echo "UNEXPECTED SUCCESS: $*" >&2; fail=1; fi; }
+
+test "$(id -u)" -eq 1200
+test "$DOCKER_HOST" = unix:///run/user/1200/docker.sock
+touch /srv/le-app-codex/tmp/phase2b-write-test
+rm /srv/le-app-codex/tmp/phase2b-write-test
+expect_denied ls /var/www
+expect_denied ls /root
+expect_denied ls /home
+expect_denied ls /srv/directus-archive
+expect_denied ls /srv/codex-work
+expect_denied stat /run/docker.sock
+expect_denied stat /var/run/docker.sock
+expect_denied stat /run/containerd/containerd.sock
+expect_denied stat /dev/sda
+expect_denied stat /proc/1/root
+expect_denied sh -c 'echo x > /etc/phase2b-write-test'
+expect_denied sh -c 'echo x > /srv/phase2b-write-test'
+expect_denied curl -4fsS --connect-timeout 2 http://127.0.0.1
+expect_denied curl -4fsS --connect-timeout 2 http://10.200.120.1
+expect_denied curl -4fsS --connect-timeout 2 http://192.168.10.151
+expect_denied nc -w2 -z 192.168.10.1 53
+expect_denied curl -4fsS --connect-timeout 2 http://10.98.0.2
+expect_denied curl -4fsS --connect-timeout 2 http://74.67.173.56
+expect_denied curl -4fsS --connect-timeout 2 http://169.254.169.254/latest/meta-data/
+expect_denied curl -6fsS --connect-timeout 2 https://[::1]/
+expect_denied nc -w2 -z 1.1.1.1 25
+expect_denied nc -w2 -z 1.1.1.1 465
+expect_denied nc -w2 -z 1.1.1.1 587
+test "$(ps -e --no-headers | wc -l)" -lt 32
+test -w /dev/fuse
+test -w /dev/net/tun
+grep -q '^nameserver 9\.9\.9\.9$' /etc/resolv.conf
+grep -q '^nameserver 149\.112\.112\.112$' /etc/resolv.conf
+getent ahostsv4 example.com >/dev/null
+test -r /sys/fs/cgroup/cpu.max
+test -r /sys/fs/cgroup/memory.max
+exit "$fail"