tawasuyu/brahman

1use std::path::PathBuf;
2
3#[derive(Debug, thiserror::Error)]
4pub enum IncarnateError {
5    #[error("namespace `{ns}` requires CAP_SYS_ADMIN or CLONE_NEWUSER (neither available)")]
6    NamespaceCapMissing { ns: &'static str },
7
8    #[error("user namespaces blocked by sysctl kernel.unprivileged_userns_clone=0")]
9    UserNsDisabledBySysctl,
10
11    #[error("user namespaces restricted by LSM (apparmor/selinux)")]
12    UserNsRestrictedByLsm,
13
14    #[error("cgroup path `{path}` is not writable (delegation missing?)")]
15    CgroupNotWritable { path: PathBuf },
16
17    #[error("payload is not executable in this incarnation path (Wasm/Virtual not supported here)")]
18    NonExecutablePayload,
19
20    #[error("clone(2) failed: {0}")]
21    Clone(#[source] nix::errno::Errno),
22
23    #[error("pipe2(2) failed: {0}")]
24    Pipe(#[source] nix::errno::Errno),
25
26    #[error("post-clone setup: {0}")]
27    PostClone(#[source] anyhow::Error),
28
29    #[error(transparent)]
30    Io(#[from] std::io::Error),
31
32    #[error("invalid argv: contains NUL byte")]
33    InvalidArgv,
34
35    #[error("rootfs path contains NUL byte (pivot_root / overlayfs)")]
36    InvalidRootfsPath,
37}
38
39/// Cuando `strict_caps = false`, errores no-fatales se reportan como
40/// `Degradation` y la encarnación continúa con menos aislamiento del pedido.
41#[derive(Debug, Clone)]
42pub enum Degradation {
43    NamespaceSkipped { ns: &'static str },
44    CgroupSkipped { path: PathBuf, reason: String },
45    CpuAffinitySkipped { reason: String },
46    UidMapFailed { reason: String },
47}