mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

add a per-agent nix builds mode, host or none, carried like privateUsers

Browse source
This commit is contained in:
atlas 2026-11-03 00:30:55 +01:00 • committed by mara
commit 5485151ba6
1 changed files with 618 additions and 58 deletions
Download patch file Download diff file Expand all files Collapse all files

5
docs/process/gotchas.md
View file

@ -306,7 +306,10 @@ nix build "git+<forge>/internal/meta.git?rev=<rev>#nixosConfigurations.argus.con
### Containerized nix-daemon needs `sandbox-fallback = true`
Agent containers bind-mount the host's nix-daemon socket. nspawn
nixos-containers' start script bind-mounts the host's nix-daemon socket
directory into every container (hyperhive adds no bind for it; an agent
with `services.hyperhive.agent.nixBuilds = "none"` gets it shadowed, see
`docs/trust-boundary/security.md`). nspawn
containers don't get user-namespaces by default, so `nix build`
invocations _inside_ the container can't set up the build sandbox
and fail outright if the host daemon's