nx_container_rootless_test.nx
buildroot/runtime/nx_container_rootless_test.nx
about
nx_container_rootless_test.nx -- proof that nx_container runs a process in a
FULLY ROOTLESS container: CLONE_NEWUSER + uid/gid map (host id -> 0 inside)
THEN unshare(mount|pid|uts|ipc), NO sudo, NO CAP_SYS_ADMIN. This is the
oracle-container lane (bench/racing_crew/vendor/ORACLES.md v2): the racing
suites run in sovereign nx_container jails that spin up/down as any user.
The entrypoint (nx_exit42) returns 42; a rootless container that captures 42
proves the whole unprivileged namespace stack + the sovereign fork/exec/wait
path (clone/execve/wait4 rv64-number fix). expect_exit: 0.
license_tier: ORIGINAL No hw writes (Rule 26).
dependencies 2 imports · 0 importers
imports: nx_syscalls_x86_64.nxnx_container.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 13 | const CLONE_NEWNS: i64 = 0x00020000 |
| 14 | const CLONE_NEWUTS: i64 = 0x04000000 |
| 15 | const CLONE_NEWIPC: i64 = 0x08000000 |
functions
| 17 | func main() -> i64 calls 1: nx_container_run |