blakeslee-research/containerization
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: add CONTAINER_ISOLATION.md — session-isolation model + build/validate workflow

Browse Source 
Overview doc so other agents/humans understand the shared-control-container
isolation work: the failure vectors + fixes (stdio wedge, connection leak,
control-plane HOL, OOM cross-kill, CPU/fork-bomb, per-session memory.max), the
host-vs-guest shipping surfaces, the per-exec cgroup layout + graceful fallback,
and the local vminit-image build/validate workflow + -nucleicN tag invariant.
Cross-linked from the vendored PATCHES.md.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
abkslm
2026-07-13 22:03:03 -07:00
co-authored by Claude Opus 4.8
parent 831d19c3a6
commit 9de6a6cee7
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
PATCHES.md
+3
View File
@@ -1,5 +1,8 @@
# Vendored `containerization` — Nucleic patches
> Overview of *why* these patches exist (the session-isolation model) + the build/validate workflow:
> [`docs/CONTAINER_ISOLATION.md`](../../docs/CONTAINER_ISOLATION.md). This file is the per-patch detail.
This is a **vendored copy** of [apple/containerization](https://github.com/apple/containerization)
at upstream commit `6b7b42ca3efeee8c706070e4355e6a807c5336ae`, referenced by the root `Package.swift`
via `.package(path: "third_party/containerization")` instead of the github URL.