Module webui 

Loopback web UI: live scheduler metrics as a small HTTP server.

The server binds [::1]:50005 first and falls back to 127.0.0.1:50005. When both TCP binds fail (for example when the loader sandbox denies inet sockets), the same routes are served over the unix socket /tmp/scx_mlfq.sock with a minimal hand-rolled HTTP/1.1 responder. The socket is created mode 0600, so only root can connect to it (socat needs sudo), matching the loopback trust boundary of the TCP path. There is no authentication: the loopback address is the trust boundary, and the counters are already world-readable through the stats server. --no-webui disables the thread entirely (see main.rs), so no bind is attempted.

The loader’s network sandbox is seccomp-based: the restriction is a per-process filter inherited by scheduler children, so a running scheduler cannot lift its own. When both TCP binds fail with a seccomp-style errno, this thread therefore writes the scheduler’s own runtime drop-in under /run/systemd/system so the next loader start lifts the sandbox for the web UI (the current run serves the unix socket), and main removes the drop-in again on exit. The lifecycle is implemented in try_unblock_loader_sandbox, restore_loader_sandbox and the pure classification helpers below.

The metrics pipeline is push-based: the run loop sends one WebMetrics snapshot per iteration over a small bounded channel (capacity 16). try_send drops a frame when the buffer is full, instead of stalling the scheduler or growing the buffer), and this thread keeps the newest snapshot behind a mutex for the HTTP handlers. The thread exits when the shared shutdown flag is set.

Structs

WebState 🔒

Latest metrics snapshot, kept behind a mutex for the HTTP handlers. The snapshot already carries the per-CPU current frequencies, refreshed in the run loop, so serving never touches sysfs.

Constants

EACCES 🔒

EAFNOSUPPORT 🔒

EPERM 🔒

POLL_INTERVAL 🔒

PORT 🔒

RUNTIME_DROPIN 🔒

The runtime drop-in file the scheduler owns for the current boot.

RUNTIME_DROPIN_DIR 🔒

Runtime drop-in directory for the loader unit, where the scheduler writes its own per-boot network-sandbox unblock. This is separate from the installer’s persistent /etc/systemd/system drop-in, which the scheduler never touches.

RUNTIME_SYSTEM_DIR 🔒

systemd’s runtime unit directory. The root-owned tree under /run (tmpfs) that PID 1 maintains for the current boot; runtime drop-ins written below it are picked up by systemctl daemon-reload and disappear on reboot.

UNIX_SOCKET_PATH 🔒

Statics

UNBLOCK_WRITTEN 🔒

Set once this run actually wrote the runtime drop-in (not merely attempted it), so the exit path knows a sandbox restore is owed. The webui thread stores it; main reads it after the run loop ends. SeqCst orders the drop-in write before the main-thread restore decision regardless of which core each ran on.

Functions

boxed_io_error 🔒

Recover the errno-bearing io::Error behind the boxed error tiny_http reports for a failed Server::http bind. tiny_http surfaces the TcpListener::bind io::Error itself (its ? boxes it directly), so the top-level downcast is the real path. The source walk guards against a future wrapper. io::Error’s source() skips a custom payload (the payload is the error, not its cause), so an errno hidden under a wrapper is still found when the wrapper exposes it through its own source() chain.

dropin_matches 🔒

True when content is byte-identical to the scheduler’s own runtime drop-in. Pure, so the ownership decision is unit-tested without a filesystem.

restore_loader_sandbox

Restore the loader’s network sandbox after a run that wrote the runtime unblock. Called once from main after the run loop ends. Idempotent (safe to call twice).

runtime_dropin_content 🔒

The exact bytes the scheduler owns for its runtime (per-boot) network-sandbox unblock. Mirrors the installer’s /etc drop-in shape. An [Service] section whose empty assignments reset the loader’s RestrictAddressFamilies=/SocketBindDeny= for the next start carries the scheduler’s own marker, so the restore path can prove a file is ours byte-for-byte before removing it.

sandbox_failure 🔒

Classify a TCP bind failure. Only a seccomp-style errno means the loader sandbox is in effect. A taken port (EADDRINUSE) is a plain “something else owns the port” and must never trigger the runtime unblock, and an unclassified error is conservatively treated as not a sandbox failure.

start

Start the web UI thread. Consumes the metrics channel and exits when the shared shutdown flag is set (or the channel is closed).

try_unblock_loader_sandbox 🔒

Try to lift the loader’s network sandbox for the next scheduler start by writing the scheduler’s own runtime drop-in under /run/systemd/system.

unix_handle_client 🔒

Serve one unix-socket client with a minimal HTTP/1.1 response. The two routes mirror the tiny_http server: / serves the embedded HTML (no-store), /api/stats the live metrics JSON, everything else a 404. A malformed request is dropped silently.