Repository navigation
fix(dstack-util): backport host-input bounds and boot ordering to 0.5.x - #1446
Merged
Merged
Conversation
Backport of #799 and #1280. The keyslot binary area must sit between the two header copies and the encrypted payload; otherwise a host with raw disk access could redirect where the key material is read from. The end of the area is computed with checked_add so a wrapping size is rejected. (cherry picked from commit 2c74e0a419ea, 5107a31 and 9b62c7c, hand-ported) Signed-off-by: Kevin Wang <wy721@qq.com>
(cherry picked from commit 793626d) Signed-off-by: Kevin Wang <wy721@qq.com>
(cherry picked from commit be458a0) Signed-off-by: Kevin Wang <wy721@qq.com>
(cherry picked from commit 195d1bf, hand-ported: 0.5.x mounts the share from system_setup.rs) Signed-off-by: Kevin Wang <wy721@qq.com>
(cherry picked from commit 9f027f7) Signed-off-by: Kevin Wang <wy721@qq.com>
kvinwang
force-pushed
the
backport/v0.5.x-guest-boundaries
branch
from
October 13, 2026 02:05
2ba61db to
63e8d71
Compare
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backports guest-side fixes from
nextto the 0.5 line for 0.5.12.offset + sizethat overflows.O_NONBLOCK, and require a regular file.remove-orphansrefuses a compose file that usesinclude:instead of deleting the included services' containers; the host share is mountednosuid,nodev,noexec.app-compose.serviceRequires=dstack-prepareand the guest agent, so the app does not start if either failed.The LUKS and mount-option changes are hand ports, because the surrounding code moved on
next. The rest arecherry-pick -xwith paths adjusted (os/common/rootfsmaps tobasefiles).Tested:
cargo test -p dstack-util(13 passed, new LUKS and include tests included), clippy, fmt.