nx_daemon_container.nx source
↩ module page · 51 lines · 2716 B
1// nx_daemon_container.nx -- run the nishi pulse daemon INSIDE the sovereign
2// container runtime (nx_container, the Docker replacement) instead of bare
3// WSL. UTS+IPC+mount namespace isolation (no PID-ns: the pulse daemon
4// self-daemonizes, so PID-1 would tear the namespace down on the parent's
5// exit). rootfs="/" => no chroot, so the daemon still sees the repo +
6// toolchain; CWD (nxc2 root) is inherited from the launcher for its relative
7// paths. Needs CAP_SYS_ADMIN (run as root). Prints the container verdict.
8// expect_exit: 0
9// license_tier: ORIGINAL
10// (direct import "nx_syscalls.nx" REMOVED 2026-07-31, debt 1785528831: this file also
11// imports nx_container.nx which imports nx_syscalls_x86_64.nx, so the direct import put
12// TWO syscall layers in one TU -- every wrapper twice, picked by definition ORDER. The
13// syscalls it needs arrive via nx_container.nx, and the raw x86 numbers 165/161/272 pass
14// through the backend translator correctly. Verified by reading emitted asm, not exit codes.)
15import "nx_container.nx"
16
17const CLONE_NEWNS: i64 = 0x00020000
18const CLONE_NEWUTS: i64 = 0x04000000
19const CLONE_NEWIPC: i64 = 0x08000000
20
21func _p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
22func _pn(v: i64) -> i64 { let b: *u8=sys_mmap(28); var m: i64=v; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{b[i]=t[k-1-i];i=i+1}; sys_write(1,b,k); return 0 }
23
24func main() -> i64 {
25 let ep: *u8 = "/tmp/nx_pulse_daemon.sov.elf" as *u8
26 var epl: i64 = 0
27 while ep[epl] != (0 as u8) { epl = epl + 1 }
28 let argv: *i64 = sys_mmap(16) as *i64
29 argv[0] = ep as i64
30 argv[1] = 0
31 let host: *u8 = sys_mmap(64)
32 host[0]=110 as u8; host[1]=105 as u8; host[2]=115 as u8; host[3]=104 as u8
33 host[4]=105 as u8; host[5]=45 as u8; host[6]=100 as u8; host[7]=109 as u8; host[8]=110 as u8 // nishi-dmn
34 let spec: *ContainerSpec = sys_mmap(96) as *ContainerSpec
35 spec.rootfs_path = "/" as *u8
36 spec.rootfs_path_len = 1
37 spec.entry_path = ep
38 spec.entry_path_len = epl
39 spec.argv = argv
40 spec.hostname = host
41 spec.namespace_flags = CLONE_NEWUTS | CLONE_NEWIPC | CLONE_NEWNS
42 let res: *ContainerResult = sys_mmap(64) as *ContainerResult
43 nx_container_run(spec, res)
44 _p("nx_daemon_container: verdict=" as *u8); _pn(res.verdict)
45 _p(" child_pid=" as *u8); _pn(res.child_pid)
46 _p(" exit=" as *u8); _pn(res.exit_code); _p("\n" as *u8)
47 // verdict 2=EXITED_OK (daemon parent forked+exited cleanly), 1=STARTED also fine
48 if res.verdict == 2 { return 0 }
49 if res.verdict == 1 { return 0 }
50 return res.verdict
51}