mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

docs: the trust-boundary pages keep the operator guidance, the mechanism moves to implementation

Browse source 
boundary.md keeps the model, the design rule, why network isolation
matters and host admin socket access; the hive-priv socket activation and
the per-agent socket directory move to 4-implementation/trust-boundary.
security.md keeps the agent trust model and the path-name rule; the nix
builds mode with its threat model, and the hive-c0re privilege separation,
move to their own pages there. Headings and text move as they were, with
one level shaved off the heading depth. Links, code and nix pointers, and
the docs index follow the moves.
This commit is contained in:
iris 2026-11-06 19:07:29 +01:00 • committed by mara
commit 30a8f71bb5
1 changed files with 338 additions and 307 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/5-project/process/gotchas.md
View file

@ -309,14 +309,14 @@ nix build "git+<forge>/internal/meta.git?rev=<rev>#nixosConfigurations.argus.con
nixos-containers' start script bind-mounts the host's nix-daemon socket
directory into every container (hyperhive adds no bind for it; an agent
with `services.hyperhive.agent.nixBuilds = "none"` gets it shadowed, see
`docs/2-handbook/trust-boundary/security.md`). nspawn
`docs/4-implementation/trust-boundary/nix-builds.md`). nspawn
containers don't get user-namespaces by default, so `nix build`
invocations _inside_ the container can't set up the build sandbox
and fail outright if the host daemon's
`nix.settings.sandbox-fallback` is `false` (nixpkgs default).
`nix/agent-modules/default.nix` does `lib.mkForce true` so builds
fall back to unsandboxed local builds rather than failing. Security
implications: `docs/2-handbook/trust-boundary/security.md`.
implications: `docs/4-implementation/trust-boundary/nix-builds.md`.
### Linking workspace binaries locally needs `nix develop`