mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

bind a namespaced agent's socket dir off /run so its owner maps to the agent user

Browse source
This commit is contained in:
atlas 2026-11-02 18:24:33 +01:00 • committed by mara
commit 6847ed865a
2 changed files with 53 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

7
nix/agent-modules/user.nix
View file

@ -199,7 +199,12 @@ in
"d ${homeDir}/.local/state 0755 ${owner} - -"
"L ${homeDir}/.local/state/nix - - - - ${persisted}"
"L ${homeDir}/.nix-profile - - - - ${homeDir}/.local/state/nix/profiles/profile"
];
]
# A namespaced agent's socket dir is bound at /agents/<name>/sockets, not
# under /run, whose tmpfs nspawn mounts before the binds and so owns the
# mount point to root (hive-c0re `socket_bind`). The harness keeps the
# /run/hive-agent path. A dir already bound there is left alone.
++ lib.optional config.services.hyperhive.agent.user.privateUsers "L /run/hive-agent/${userName} - - - - /agents/${userName}/sockets";
# `NOPASSWD: ALL` for the agent user. Lets claude's Bash tool
# keep working with anything that expected root (systemctl,

5
nix/vm-tests/agent-ephemeral-rootfs.nix
View file

@ -54,7 +54,7 @@ let
++ [
{
host_path = nsSocketDir;
container_path = nsSocketDir;
container_path = "/agents/${nsAgent}/sockets";
read_only = false;
}
];
@ -368,6 +368,9 @@ pkgs.testers.runNixOSTest {
assert as_ns(f"cat /agents/{NS_AGENT}/state/pre.txt") == "before"
assert as_ns(f"stat -c %u:%g /agents/{NS_AGENT}/state/pre.txt") == "1000:1000"
as_ns(f"echo after > /agents/{NS_AGENT}/state/post.txt")
# The socket dir is bound off /run (an owneridmap mount point under the
# container's /run tmpfs would belong to root) and linked back.
assert as_ns(f"readlink /run/hive-agent/{NS_AGENT}") == f"/agents/{NS_AGENT}/sockets"
as_ns(f"touch /run/hive-agent/{NS_AGENT}/web.sock")
assert as_ns(f"cat /agents/{NS_AGENT}/config/cfg") == "from-config"
host.fail(f"nixos-container run {NS} -- runuser -l {NS_AGENT} -c 'touch /agents/{NS_AGENT}/config/new'")