mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

bind a namespaced agent's socket dir off /run so its owner maps to the agent user

Browse source
This commit is contained in:
atlas 2026-11-02 18:24:33 +01:00 • committed by mara
commit 6847ed865a
1 changed files with 53 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/agent-lifecycle/persistence.md
View file

@ -745,6 +745,10 @@ container lifetime:
on the host before every start; the harness binds its sockets
there as the agent user. Why the mode matters:
[`boundary.md`](../trust-boundary/boundary.md#the-per-agent-socket-dir).
A namespaced agent has the dir bound at `/agents/<name>/sockets` and
linked from `/run/hive-agent/<name>`; the activation chowns nothing, because
a mount point under `/run` would belong to root and the id mapping would
give the agent user no ids there.
## Matrix per-agent daemon + token-arrival trigger