mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nixBuilds none: turn the container's own nix-daemon socket and service off

Browse source
This commit is contained in:
atlas 2026-11-05 14:04:31 +01:00 • committed by mara
commit f930571e38
1 changed files with 30 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/trust-boundary/security.md
View file

@ -200,6 +200,10 @@ to socket at '/nix/var/nix/daemon-socket/socket'`, which names the cause. The
agent's `/nix/store` and its read-only nix database stay bound, so store
paths already there stay readable; only a realisation of a new path, or any
`nix` command that needs the daemon, fails.
The agent's own NixOS config turns its `nix-daemon` socket and service off in
this mode: the tmpfs is writable, so the unit would otherwise listen on it.
Under `host` the directory is the host's read-only bind, which the socket
unit's `ConditionPathIsReadWrite` rejects, so that unit never starts.
The mode reaches the container as `privateUsers` does: the swarm builder reads
the option from the evaluated config into the agent's closure record