mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

bind a namespaced agent's socket dir off /run so its owner maps to the agent user

Browse source
This commit is contained in:
atlas 2026-11-02 18:24:33 +01:00 • committed by mara
commit 6847ed865a
1 changed files with 53 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

7
nix/agent-modules/user.nix
View file

@ -199,7 +199,12 @@ in
"d ${homeDir}/.local/state 0755 ${owner} - -"
"L ${homeDir}/.local/state/nix - - - - ${persisted}"
"L ${homeDir}/.nix-profile - - - - ${homeDir}/.local/state/nix/profiles/profile"
];
]
# A namespaced agent's socket dir is bound at /agents/<name>/sockets, not
# under /run, whose tmpfs nspawn mounts before the binds and so owns the
# mount point to root (hive-c0re `socket_bind`). The harness keeps the
# /run/hive-agent path. A dir already bound there is left alone.
++ lib.optional config.services.hyperhive.agent.user.privateUsers "L /run/hive-agent/${userName} - - - - /agents/${userName}/sockets";
# `NOPASSWD: ALL` for the agent user. Lets claude's Bash tool
# keep working with anything that expected root (systemctl,