refactor(config): restructure OCI config parser and mount subsystem

- Rename `config` → `Config`, move to PascalCase per C++ conventions
- Split `mount_t::flags` into `vfs_flags`, `propagation_flags`, `rec_attr`
- Move `id_mapping_t` to `Config` scope for reuse across mount and linux
- Extract `resources_t` under `linux_t` matching OCI spec hierarchy
- Make `root`, `process`, `user` optional per spec (user defaults to 0/0)
- Fix `netDevices` type from `vector` to `unordered_map` per spec
- Fix hooks.env from `unordered_map` to `vector<string>` with KEY=VALUE
  validation per POSIX environ semantics

Extract:
- `config/kernel_fallbacks.h` — kernel constant compat for older headers
- `config/mount_options.h` — mount flag lookup tables and dump()
- `utils/enum_traits.h` — generic enum_table + SFINAE bitmask operators

Seccomp:
- Replace string fields with typed action_t/arch_t/flag_t enums
- Validate errnoRet only valid with ERRNO/TRACE actions
- Validate NOTIFY requires listenerPath
- Decouple arch_t values from libseccomp constants for 2.3.3 compat

Performance:
- close_other_fds uses close_range() syscall instead of per-fd loop
- set_capabilities bounding set uses vector<bool> mask for O(n) drop
- get_last_cap uses static local for one-time /proc read

Safety:
- Remove __builtin_unreachable() from to_string_view (UB on unknown)
- Add null check for cap_init() before unique_ptr construction
- Explicit long args for prctl() to avoid sign-extension issues
- Add overflow validation in parse_range_list
- UNLIKELY annotations on all validation/error branches

Removed:
- All to_json functions (one-way parse only)
- Old per-enum bitwise operator overloads (replaced by enum_traits)
- Unused includes: <set>, <dirent.h>, platform.h

Signed-off-by: Yuming He <ComixHe1895@outlook.com>

Author: ComixHe

CMakeLists.txt

@@ -251,9 +251,11 @@ find_package(PkgConfig REQUIRED)
 if(linyaps-box_ENABLE_SECCOMP)
   pkg_check_modules(libseccomp REQUIRED IMPORTED_TARGET libseccomp>=2.3.3)
   list(APPEND linyaps-box_LIBRARY_LINK_LIBRARIES PUBLIC PkgConfig::libseccomp)
+  #TODO: detect seccomp_arch_resolve_name and use if available
 endif()
 
 if(linyaps-box_ENABLE_CAP)
+  #TODO: remove libcap and implement it by ourself
   pkg_check_modules(libcap REQUIRED IMPORTED_TARGET libcap>=2.25)
   list(APPEND linyaps-box_LIBRARY_LINK_LIBRARIES PUBLIC PkgConfig::libcap)
 endif()
@@ -341,6 +343,10 @@ endif()
 if(linyaps-box_ENABLE_SECCOMP)
   target_compile_definitions("${linyaps-box_LIBRARY}"
                              PUBLIC LINYAPS_BOX_ENABLE_SECCOMP)
+  if(linyaps-box_HAVE_SECCOMP_ARCH_RESOLVE_NAME)
+    target_compile_definitions("${linyaps-box_LIBRARY}"
+                               PUBLIC SECCOMP_ARCH_RESOLVE_NAME=1)
+  endif()
 endif()
 
 if(linyaps-box_ENABLE_CAP)

src/linyaps_box/app.cpp

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2025 UnionTech Software Technology Co., Ltd.
+// SPDX-FileCopyrightText: 2025 - 2026 UnionTech Software Technology Co., Ltd.
 //
 // SPDX-License-Identifier: LGPL-3.0-or-later
 
@@ -44,22 +44,22 @@ try {
         return opts.global.return_code;
     }
 
-    return std::visit(utils::Overload{ [](const command::list_options &options) {
+    return std::visit(utils::Overload{ [](const command::list_options &options) -> int {
                                           command::list(options);
                                           return 0;
                                       },
                                        [](const command::exec_options &options) -> int {
                                            return command::exec(options);
                                        },
-                                       [](const command::kill_options &options) {
+                                       [](const command::kill_options &options) -> int {
                                            command::kill(options);
                                            return 0;
                                        },
-                                       [](const command::run_options &options) {
+                                       [](const command::run_options &options) -> int {
                                            return command::run(options);
                                        },
-                                       [](const std::monostate &) {
-                                           return 0;
+                                       [](const std::monostate &) -> int {
+                                           __builtin_unreachable();
                                        } },
                       opts.subcommand_opt);
 } catch (const std::exception &e) {

src/linyaps_box/command/exec.cpp

@@ -7,6 +7,10 @@
 #include "linyaps_box/runtime.h"
 #include "linyaps_box/status_directory_manager.h"
 
+#ifdef LINYAPS_BOX_ENABLE_CAP
+#  include <sys/capability.h>
+#endif
+
 auto linyaps_box::command::exec(const struct exec_options &options) -> int
 {
     status_directory_manager mgr(options.global_.get().root);
@@ -37,30 +41,21 @@ auto linyaps_box::command::exec(const struct exec_options &options) -> int
             option.proc.capabilities.emplace();
         }
 
-        auto transform_cap = [&caps](std::optional<std::vector<cap_value_t>> &cap_set) {
-            if (!cap_set) {
-                cap_set.emplace();
+        std::vector<cap_value_t> parsed;
+        parsed.reserve(caps.size());
+        for (const auto &name : caps) {
+            cap_value_t val{ };
+            if (cap_from_name(name.c_str(), &val) < 0) {
+                throw std::system_error(errno, std::system_category(), "cap_from_name");
             }
 
-            cap_set->reserve(caps.size());
-            std::transform(
-              caps.cbegin(),
-              caps.cend(),
-              std::back_inserter(*cap_set),
-              [](const std::string &cap) {
-                  cap_value_t val{ 0 };
-                  if (cap_from_name(cap.c_str(), &val) < 0) {
-                      throw std::system_error(errno, std::system_category(), "cap_from_name");
-                  }
-
-                  return val;
-              });
-        };
+            parsed.push_back(val);
+        }
 
-        transform_cap(option.proc.capabilities->effective);
-        transform_cap(option.proc.capabilities->ambient);
-        transform_cap(option.proc.capabilities->bounding);
-        transform_cap(option.proc.capabilities->permitted);
+        option.proc.capabilities->effective = parsed;
+        option.proc.capabilities->ambient = parsed;
+        option.proc.capabilities->bounding = parsed;
+        option.proc.capabilities->permitted = parsed;
     }
 #endif
 

src/linyaps_box/command/options.cpp

@@ -19,7 +19,7 @@ linyaps_box::command::options linyaps_box::command::parse(int argc, char *argv[]
     app.set_version_flag("-v,--version", [] {
         std::stringstream ss;
         ss << "ll-box version " << LINYAPS_BOX_VERSION << "\n";
-        ss << "spec " << linyaps_box::config::oci_version;
+        ss << "spec " << linyaps_box::Config::oci_version;
         return ss.str();
     });
     app.require_subcommand();
@@ -155,7 +155,7 @@ linyaps_box::command::options linyaps_box::command::parse(int argc, char *argv[]
     }
 
     if (cmd_list->parsed()) {
-        options.subcommand_opt = std::move(list_opt);
+        options.subcommand_opt = list_opt;
     } else if (cmd_run->parsed()) {
         options.subcommand_opt = std::move(run_opt);
     } else if (cmd_exec->parsed()) {

src/linyaps_box/command/run.cpp

@@ -6,6 +6,7 @@
 
 #include "linyaps_box/runtime.h"
 #include "linyaps_box/status_directory_manager.h"
+#include "linyaps_box/utils/utils.h"
 
 auto linyaps_box::command::run(const struct run_options &options) -> int
 {
@@ -20,7 +21,12 @@ auto linyaps_box::command::run(const struct run_options &options) -> int
     run_container_options_t run_options;
     run_options.preserve_fds = options.preserve_fds;
 
-    if (container.get_config().process.terminal && options.console_socket) {
+    const auto &cfg = container.get_config();
+    if (UNLIKELY(!cfg.process || !cfg.root)) {
+        throw std::runtime_error("'process' and 'root' are required for run a container");
+    }
+
+    if (container.get_config().process->terminal && options.console_socket) {
         run_options.console_socket = unix_socket::connect(options.console_socket.value());
     }