mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

bind a namespaced agent's socket dir off /run so its owner maps to the agent user

Browse source
This commit is contained in:
atlas 2026-11-02 18:24:33 +01:00 • committed by mara
commit 6847ed865a
1 changed files with 53 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

5
nix/vm-tests/agent-ephemeral-rootfs.nix
View file

@ -54,7 +54,7 @@ let
++ [
{
host_path = nsSocketDir;
container_path = nsSocketDir;
container_path = "/agents/${nsAgent}/sockets";
read_only = false;
}
];
@ -368,6 +368,9 @@ pkgs.testers.runNixOSTest {
assert as_ns(f"cat /agents/{NS_AGENT}/state/pre.txt") == "before"
assert as_ns(f"stat -c %u:%g /agents/{NS_AGENT}/state/pre.txt") == "1000:1000"
as_ns(f"echo after > /agents/{NS_AGENT}/state/post.txt")
# The socket dir is bound off /run (an owneridmap mount point under the
# container's /run tmpfs would belong to root) and linked back.
assert as_ns(f"readlink /run/hive-agent/{NS_AGENT}") == f"/agents/{NS_AGENT}/sockets"
as_ns(f"touch /run/hive-agent/{NS_AGENT}/web.sock")
assert as_ns(f"cat /agents/{NS_AGENT}/config/cfg") == "from-config"
host.fail(f"nixos-container run {NS} -- runuser -l {NS_AGENT} -c 'touch /agents/{NS_AGENT}/config/new'")