procd: update to git HEAD of 2026-09-13

Various fixes and improvements in procd/ujail/uxc to better support
the use of ujail and uxc as container runtime environments, now
compliant with the OCI run-time spec version 1.3.0.

Also brings basic udebug tracing support and replaces the seccomp
preload libraries with a ucode implementation: procd-seccomp ships
trace2seccomp plus its utrace and seccomp-trace aliases and needs only
ucode and its fs module, while the OCI seccomp code now links into
ujail. uxc installs the new uxc-net and uxc-stack helpers and depends
on the ucode modules they use, and on odhcpd, which serves RA, DHCPv6
and DHCPv4 on container networks.

Adjacent changes in firewall4, netifd and odhcpd still have to find
their way into the tree for dynamically addressed native uxc
containers to be fully functional.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

package/system/procd/Makefile

@@ -12,9 +12,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/procd.git
-PKG_MIRROR_HASH:=bd9e510b303b58f1edb1bfc4629e523f9a96c80a5b66cf5c972f9245bfec5596
+PKG_MIRROR_HASH:=8ce832e630f4b62382b997156af3ca947602297b0f9158eb068ab205f5506cbf
-PKG_SOURCE_DATE:=2026-06-17
+PKG_SOURCE_DATE:=2026-09-13
-PKG_SOURCE_VERSION:=60fdbf00e924fff0a510c4ec31c520d35e69bfe1
+PKG_SOURCE_VERSION:=0df1972a90e3316a9e2319ea8b606e89f700b360
 CMAKE_INSTALL:=1
 
 PKG_LICENSE:=GPL-2.0
@@ -65,21 +65,21 @@ define Package/procd-ujail
   SECTION:=base
   CATEGORY:=Base system
   DEPENDS:=@KERNEL_NAMESPACES +@KERNEL_UTS_NS +@KERNEL_IPC_NS +@KERNEL_PID_NS \
-	  +libubox +libubus +libuci +libblobmsg-json
+	  +libubox +libubus +libuci +libblobmsg-json +libudebug
   TITLE:=OpenWrt process jail helper
 endef
 
 define Package/procd-seccomp
   SECTION:=base
   CATEGORY:=Base system
-  DEPENDS:=@USE_SECCOMP +libubox +libblobmsg-json
+  DEPENDS:=@USE_SECCOMP +ucode +ucode-mod-fs
-  TITLE:=OpenWrt process seccomp helper + utrace
+  TITLE:=OpenWrt process seccomp helper + trace2seccomp
 endef
 
 define Package/uxc
   SECTION:=base
   CATEGORY:=Base system
-  DEPENDS:=+procd-ujail +libubus +libubox +libblobmsg-json +blockd +PACKAGE_uxc:rpcd
+  DEPENDS:=+procd-ujail +libubus +libubox +libblobmsg-json +blockd +odhcpd +ucode +ucode-mod-fs +ucode-mod-ubus +ucode-mod-uci +ucode-mod-uloop +PACKAGE_uxc:rpcd
   TITLE:=OpenWrt container management
   MAINTAINER:=Daniel Golle <daniel@makrotopia.org>
 endef
@@ -130,11 +130,10 @@ define Package/procd-ujail/install
 endef
 
 define Package/procd-seccomp/install
-	$(INSTALL_DIR) $(1)/sbin $(1)/lib
+	$(INSTALL_DIR) $(1)/sbin
-	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/libpreload-seccomp.so $(1)/lib
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/trace2seccomp $(1)/sbin/
-	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/utrace $(1)/sbin/
+	$(LN) trace2seccomp $(1)/sbin/utrace
-	$(LN) utrace $(1)/sbin/seccomp-trace
+	$(LN) trace2seccomp $(1)/sbin/seccomp-trace
-	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/libpreload-trace.so $(1)/lib
 endef
 
 define Package/uxc/conffiles
@@ -142,10 +141,15 @@ define Package/uxc/conffiles
 endef
 
 define Package/uxc/install
-	$(INSTALL_DIR) $(1)/sbin
+	$(INSTALL_DIR) $(1)/sbin $(1)/usr/share/uxc
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/uxc $(1)/sbin/
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/uxc-net $(1)/sbin/
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/uxc-stack $(1)/sbin/
+	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/share/uxc/uxc-stack.uc $(1)/usr/share/uxc/
 	$(INSTALL_DIR) $(1)/etc/init.d
 	$(INSTALL_BIN) ./files/uxc.init $(1)/etc/init.d/uxc
+	$(INSTALL_DIR) $(1)/lib/functions
+	$(INSTALL_DATA) ./files/uxc.sh $(1)/lib/functions/
 endef
 
 $(eval $(call BuildPackage,procd))

package/system/procd/files/uxc.init

@@ -6,11 +6,22 @@ NAME=uxc
 PROG=/sbin/uxc
 
 start_service() {
+	local ready
+
+	ready=$(ubus call block status 2>/dev/null | jsonfilter -e '@.ready')
+	[ "$ready" = "true" ] || return 0
+
 	procd_open_instance "uxc"
 	procd_set_param command "$PROG" boot
 	procd_close_instance
 }
 
-service_triggers() {
+reload_service() {
-	procd_add_raw_trigger "mount.add" 3000 /etc/init.d/uxc start
+	"$PROG" boot
+}
+
+service_triggers() {
+	procd_add_raw_trigger "mount.ready" 250 /etc/init.d/uxc reload
+	procd_add_raw_trigger "mount.add" 250 /etc/init.d/uxc reload
+	procd_add_raw_trigger "uxc.bringup" 250 /etc/init.d/uxc reload
 }

package/system/procd/files/uxc.sh

@@ -0,0 +1,96 @@
+# uxc container package-hook helpers, sourced by the install scripts of
+# container-<name> and stack-<app> packages.
+
+UXC_STOP_WAIT=15
+
+uxc_preinst() {
+	local name="$1" newvol="$2" newsize="$3"
+	local reg="/tmp/run/uvol/.meta/uxc/$name.json"
+	local oldvol free i
+
+	[ -n "$IPKG_INSTROOT" ] && return 0
+
+	if [ ! -L /tmp/run/uvol/.meta ]; then
+		echo "uxc: cannot install '$name': the uvol metadata volume is not mounted at /tmp/run/uvol/.meta" >&2
+		echo "uxc: no usable uvol backend; install 'autopart' (block), or provision an LVM VG / UBI space for uvol" >&2
+		return 1
+	fi
+
+	[ -f "$reg" ] || return 0
+
+	oldvol="$(sed -n 's|.*"path"[: ]*"/tmp/run/uvol/\([^"]*\)".*|\1|p' "$reg")"
+	[ -z "$oldvol" ] && return 0
+	[ "$oldvol" = "$newvol" ] && return 0
+
+	uxc kill "$name" KILL 2>/dev/null
+	i=0
+	while [ "$i" -lt "$UXC_STOP_WAIT" ] && uxc list 2>/dev/null | grep -qE "^$name[[:space:]].*[[:space:]]running"; do
+		sleep 1
+		i=$((i + 1))
+	done
+
+	free="$(uvol free 2>/dev/null)"
+	if [ -n "$free" ] && [ -n "$newsize" ] && [ "$free" -lt "$newsize" ]; then
+		uvol down "$oldvol" 2>/dev/null
+		uvol remove "$oldvol" 2>/dev/null
+	fi
+
+	return 0
+}
+
+uxc_postinst() {
+	local name="$1"
+
+	[ -n "$IPKG_INSTROOT" ] && return 0
+	uxc create "$name" 2>/dev/null
+	uxc start "$name" 2>/dev/null
+
+	return 0
+}
+
+uxc_prerm() {
+	local name="$1"
+
+	[ -n "$IPKG_INSTROOT" ] && return 0
+	uxc kill "$name" 2>/dev/null
+
+	return 0
+}
+
+uxc_postrm() {
+	local name="$1" left
+
+	[ -n "$IPKG_INSTROOT" ] && return 0
+
+	rm -rf "/tmp/run/uvol/.meta/uxc/state/$name" "/tmp/run/uvol/.meta/uxc/settings/$name.json"
+
+	left="$(uvol list 2>/dev/null | while read -r vn rest; do
+		case "$vn" in "$name"|"$name".*) echo "$vn";; esac
+	done)"
+	[ -z "$left" ] && return 0
+
+	echo "container '$name' removed; persistent data volumes were kept. To delete this data, run:" >&2
+	echo "$left" | sed 's/^/  uvol remove /' >&2
+
+	return 0
+}
+
+# The $IPKG_INSTROOT guards live in this file rather than in an
+# in-Makefile define, where make eats the dollar sign.
+uxc_stack_postinst() {
+	local app="$1"
+
+	[ -n "$IPKG_INSTROOT" ] && return 0
+	uxc-stack up "$app"
+
+	return 0
+}
+
+uxc_stack_prerm() {
+	local app="$1"
+
+	[ -n "$IPKG_INSTROOT" ] && return 0
+	uxc-stack down "$app"
+
+	return 0
+}