[Sangho Lee (sangho2)]

This PR adds the containerd shim that runs each container in a LiteBox sandbox. The shim builds the guest's file system from the container's image and read-only mounts, starts the userland broker with the guest service (#1813) as its first process, and drives the service over the broker's hybrid vsock using the guest service protocol (#1809). It works with ctr and nerdctl on rootful and rootless containerd. Note that it only supports read-only mounts for now due to security concerns (thus doesn't work with Kubernetes).

[github-actions]

ℹ️ Note: This semver check was run against the sanghle/ulitebox/guest_service_2_service branch, not main or ulitebox.

🤖 SemverChecks 🤖 ⚠️ Potential breaking API changes detected ⚠️

Click for details

--- failure inherent_method_missing: pub method removed or renamed ---

Description:
A publicly-visible method or associated fn is no longer available under its prior name. It may have been renamed or removed entirely.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/inherent_method_missing.ron

Failed in:
  LocalFs::new_read_only, previously in file /home/runner/work/litebox/litebox/target/semver-checks/git-sanghle_ulitebox_guest_service_2_service/5ec209be1cb73928c0f5ab3fdbbeaed1f913ec7d/litebox_broker_userland/src/fs/mod.rs:361

--- failure enum_no_repr_variant_discriminant_changed: enum variant had its discriminant change value ---

Description:
The enum's variant had its discriminant value change. This breaks downstream code that used its value via a numeric cast like `as isize`.
        ref: https://doc.rust-lang.org/reference/items/enumerations.html#assigning-discriminant-values
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.51.0/src/lints/enum_no_repr_variant_discriminant_changed.ron

Failed in:
  variant SyscallRequest::RtSigsuspend 27 -> 28 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:2929
  variant SyscallRequest::RtSigaction 28 -> 29 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:2933
  variant SyscallRequest::RtSigreturn 29 -> 30 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:2939
  variant SyscallRequest::Kill 30 -> 31 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:2940
  variant SyscallRequest::Tkill 31 -> 32 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:2944
  variant SyscallRequest::Tgkill 32 -> 33 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:2948
  variant SyscallRequest::Sigaltstack 33 -> 34 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:2953
  variant SyscallRequest::Ioctl 34 -> 35 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:2957
  variant SyscallRequest::Pread64 35 -> 36 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:2961
  variant SyscallRequest::Pwrite64 36 -> 37 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:2967
  variant SyscallRequest::Sendfile 37 -> 38 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:2973
  variant SyscallRequest::Readv 38 -> 39 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:2979
  variant SyscallRequest::Writev 39 -> 40 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:2984
  variant SyscallRequest::Preadv 40 -> 41 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:2989
  variant SyscallRequest::Pwritev 41 -> 42 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:2996
  variant SyscallRequest::Faccessat 42 -> 43 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3003
  variant SyscallRequest::Madvise 43 -> 44 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3009
  variant SyscallRequest::Dup 44 -> 45 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3014
  variant SyscallRequest::Socket 45 -> 46 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3019
  variant SyscallRequest::Socketpair 46 -> 47 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3024
  variant SyscallRequest::Connect 47 -> 48 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3030
  variant SyscallRequest::Accept 48 -> 49 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3035
  variant SyscallRequest::Sendto 49 -> 50 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3041
  variant SyscallRequest::Sendmsg 50 -> 51 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3049
  variant SyscallRequest::Sendmmsg 51 -> 52 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3054
  variant SyscallRequest::Recvfrom 52 -> 53 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3060
  variant SyscallRequest::Recvmsg 53 -> 54 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3068
  variant SyscallRequest::Recvmmsg 54 -> 55 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3073
  variant SyscallRequest::Shutdown 55 -> 56 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3080
  variant SyscallRequest::Bind 56 -> 57 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3084
  variant SyscallRequest::Listen 57 -> 58 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3089
  variant SyscallRequest::Setsockopt 58 -> 59 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3093
  variant SyscallRequest::Getsockopt 59 -> 60 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3100
  variant SyscallRequest::Getsockname 60 -> 61 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3107
  variant SyscallRequest::Getpeername 61 -> 62 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3112
  variant SyscallRequest::Uname 62 -> 63 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3117
  variant SyscallRequest::Statfs 63 -> 64 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3120
  variant SyscallRequest::Fstatfs 64 -> 65 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3124
  variant SyscallRequest::Fcntl 65 -> 66 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3128
  variant SyscallRequest::Getcwd 66 -> 67 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3132
  variant SyscallRequest::EpollCtl 67 -> 68 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3136
  variant SyscallRequest::EpollPwait 68 -> 69 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3142
  variant SyscallRequest::EpollCreate 69 -> 70 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3150
  variant SyscallRequest::Poll 70 -> 71 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3154
  variant SyscallRequest::Ppoll 71 -> 72 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3159
  variant SyscallRequest::Pselect 72 -> 73 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3166
  variant SyscallRequest::ArchPrctl 73 -> 74 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3174
  variant SyscallRequest::Readlink 74 -> 75 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3177
  variant SyscallRequest::Readlinkat 75 -> 76 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3182
  variant SyscallRequest::Openat 76 -> 77 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3188
  variant SyscallRequest::Ftruncate 77 -> 78 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3194
  variant SyscallRequest::Mknodat 78 -> 79 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3198
  variant SyscallRequest::Unlinkat 79 -> 80 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3204
  variant SyscallRequest::Renameat2 80 -> 81 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3209
  variant SyscallRequest::Newfstatat 81 -> 82 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3216
  variant SyscallRequest::Eventfd2 82 -> 83 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3222
  variant SyscallRequest::Pipe2 83 -> 84 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3226
  variant SyscallRequest::Clone 84 -> 85 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3230
  variant SyscallRequest::Clone3 85 -> 86 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3233
  variant SyscallRequest::SetThreadArea 86 -> 87 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3238
  variant SyscallRequest::ClockGettime 87 -> 88 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3241
  variant SyscallRequest::ClockGetres 88 -> 89 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3245
  variant SyscallRequest::ClockNanosleep 89 -> 90 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3249
  variant SyscallRequest::Gettimeofday 90 -> 91 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3255
  variant SyscallRequest::Time 91 -> 92 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3259
  variant SyscallRequest::Getrusage 92 -> 93 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3262
  variant SyscallRequest::Times 93 -> 94 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3266
  variant SyscallRequest::Getrlimit 94 -> 95 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3269
  variant SyscallRequest::Setrlimit 95 -> 96 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3273
  variant SyscallRequest::Prlimit 96 -> 97 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3277
  variant SyscallRequest::SetTidAddress 97 -> 98 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3288
  variant SyscallRequest::Gettid 98 -> 99 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3291
  variant SyscallRequest::SetRobustList 99 -> 100 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3292
  variant SyscallRequest::GetRobustList 100 -> 101 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3295
  variant SyscallRequest::GetRandom 101 -> 102 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3300
  variant SyscallRequest::Getpid 102 -> 103 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3305
  variant SyscallRequest::Getppid 103 -> 104 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3306
  variant SyscallRequest::Setpgid 104 -> 105 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3307
  variant SyscallRequest::Getpgid 105 -> 106 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3311
  variant SyscallRequest::Getpgrp 106 -> 107 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3314
  variant SyscallRequest::Setsid 107 -> 108 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3315
  variant SyscallRequest::Getsid 108 -> 109 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3316
  variant SyscallRequest::Getuid 109 -> 110 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3319
  variant SyscallRequest::Geteuid 110 -> 111 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3320
  variant SyscallRequest::Getgid 111 -> 112 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3321
  variant SyscallRequest::Getegid 112 -> 113 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3322
  variant SyscallRequest::Getgroups 113 -> 114 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3323
  variant SyscallRequest::Sysinfo 114 -> 115 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3327
  variant SyscallRequest::CapGet 115 -> 116 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3330
  variant SyscallRequest::GetDirent64 116 -> 117 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3334
  variant SyscallRequest::SchedGetAffinity 117 -> 118 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3339
  variant SyscallRequest::SchedGetParam 118 -> 119 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3344
  variant SyscallRequest::SchedGetScheduler 119 -> 120 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3348
  variant SyscallRequest::SchedYield 120 -> 121 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3351
  variant SyscallRequest::Futex 121 -> 122 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3352
  variant SyscallRequest::Execve 122 -> 123 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3355
  variant SyscallRequest::Umask 123 -> 124 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3360
  variant SyscallRequest::Prctl 124 -> 125 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3363
  variant SyscallRequest::Alarm 125 -> 126 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3366
  variant SyscallRequest::Pause 126 -> 127 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3369
  variant SyscallRequest::RestartSyscall 127 -> 128 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3370
  variant SyscallRequest::SetITimer 128 -> 129 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3371
  variant SyscallRequest::GetITimer 129 -> 130 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3376
  variant SyscallRequest::Statx 130 -> 131 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3380
  variant SyscallRequest::TimerfdCreate 131 -> 132 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3387
  variant SyscallRequest::TimerfdSettime 132 -> 133 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3391
  variant SyscallRequest::TimerfdGettime 133 -> 134 in /home/runner/work/litebox/litebox/litebox_common_linux/src/lib.rs:3397