From 03fc548b0ac57c2b51a58d72a0b9505b8abee3de Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Sat, 24 Oct 2026 03:36:21 +0200
Subject: [PATCH] module-eval: four containers left on the host netns

---
 nix/module-eval/swarm-services-switch.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/nix/module-eval/swarm-services-switch.nix b/nix/module-eval/swarm-services-switch.nix
index 8b78bd2a..56fd0be9 100644
--- a/nix/module-eval/swarm-services-switch.nix
+++ b/nix/module-eval/swarm-services-switch.nix
@@ -617,12 +617,14 @@ let
     }
     {
       # Both values come from ../container-modules/swarm-container.nix.
+      # Four of the 14 service containers share the host netns (hive-forge, bao,
+      # the queue, the log store) and ten have one of their own.
       name = "a service container on the host netns runs no firewall or resolvconf of its own";
       ok =
         let
           shared = lib.filter (c: !c.privateNetwork) (lib.attrValues serviceContainers);
         in
-        lib.length shared == 5
+        lib.length shared == 4
         && lib.all (
           c: !c.config.networking.firewall.enable && !c.config.networking.resolvconf.enable
         ) shared;