mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

say the store check is an allowlist: only ext4, btrfs and xfs pass

Browse source
This commit is contained in:
atlas 2026-11-06 12:37:03 +01:00
commit 419d087702
1 changed files with 15 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docs/agent-lifecycle/persistence.md
View file

@ -489,10 +489,14 @@ hive-c0re can't read, or none, leaves the agent as it is.
`claude/` dirs and its socket dir with `owneridmap`, and every other bind too
(config, `/knowledge`, the runtime dir), whose owner shows as root inside.
- **`/nix/store` has to be on ext4, btrfs or xfs.** nspawn mounts the store
into a namespaced container idmapped, which other filesystems (overlayfs,
tmpfs, older zfs) refuse. `WriteNspawnFlags` for an opted-in agent checks
the `statfs` type of `/nix/store` and fails with the type and the fix,
before it moves anything. Check a host with `findmnt -no FSTYPE /nix/store`.
into a namespaced container idmapped, and the kernel refuses that on
overlayfs and on some other filesystems. `WriteNspawnFlags` for an opted-in
agent checks the `statfs` type of `/nix/store` against an allowlist of those
three. The check refuses every other filesystem, zfs and tmpfs included, even
where a newer kernel could idmap it, because the gate exists to stop a
container that would not boot. The error names the type and the fix, and
comes before anything moves. Check a host with
`findmnt -no FSTYPE /nix/store`.
- **The container starts with `--private-users=pick --private-users-ownership=map`.**
nspawn idmaps the root at mount time, so a different range for `pick` never
walks or chowns it.