mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nixBuilds none: turn the container's own nix-daemon socket and service off

Browse source
This commit is contained in:
atlas 2026-11-05 14:04:31 +01:00 • committed by mara
commit f930571e38
1 changed files with 30 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

15
nix/agent-modules/default.nix
View file

@ -153,6 +153,8 @@ in
`nix build`, `nix run`, `nix shell` and the like fail for anything not
already in the store, with a "cannot connect to socket" error. The
agent's own system closure stays readable.
The container's own nix-daemon socket and service are off, so nothing
in the container listens on that path either.
The swarm builder reads the option from the evaluated config into the
agent's closure record, and the hive applies it when it next starts the
@ -267,6 +269,19 @@ in
# read-only filesystem.
systemd.globalEnvironment.NIX_REMOTE = "daemon";
# Under `nixBuilds = "none"` the daemon directory is an empty tmpfs, which
# the nix-daemon socket unit's `ConditionPathIsReadWrite` accepts, so the
# container's own daemon would listen there and hand out the very socket
# the mode withholds. Under `host` the directory is the host's read-only
# bind, the condition fails, and the unit stays inactive. `nix.enable`
# stays on, so the client and the read-only store remain usable.
systemd.sockets.nix-daemon.enable = lib.mkIf (
config.services.hyperhive.agent.nixBuilds == "none"
) false;
systemd.services.nix-daemon.enable = lib.mkIf (
config.services.hyperhive.agent.nixBuilds == "none"
) false;
# `claude-code` is unfree. Each per-agent container's nixosConfiguration
# evaluates its own `nixpkgs` instance, so the operator's host-level
# `nixpkgs.config.allowUnfreePredicate` does not propagate into here —