vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

nix/harness: recursive chown of /run/hive (stale root-owned files survive container restart)

Browse source
This commit is contained in:
müde 2026-05-30 22:19:22 +02:00
commit 113e64e481
2 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nix/templates/agent-base.nix
View file

@ -45,7 +45,7 @@ in
# `+` runs ExecStartPre as root (before the User= drop) so # `+` runs ExecStartPre as root (before the User= drop) so
# we can chown the bind onto the agent user every start — # we can chown the bind onto the agent user every start —
# robust against activation-script timing on first boot. # robust against activation-script timing on first boot.
ExecStartPre = "+${pkgs.coreutils}/bin/chown ${userName}:${userName} /run/hive"; ExecStartPre = "+${pkgs.coreutils}/bin/chown -R ${userName}:${userName} /run/hive";
# Run the harness as the per-agent user (#658). claude itself # Run the harness as the per-agent user (#658). claude itself
# spawned by the harness then runs as that user too — drops # spawned by the harness then runs as that user too — drops
# root inside the container while sudo (`NOPASSWD: ALL` by # root inside the container while sudo (`NOPASSWD: ALL` by

2
nix/templates/manager.nix
View file

@ -55,7 +55,7 @@ in
# `+` runs ExecStartPre as root (before the User= drop) so # `+` runs ExecStartPre as root (before the User= drop) so
# we can chown the bind onto the agent user every start — # we can chown the bind onto the agent user every start —
# robust against activation-script timing on first boot. # robust against activation-script timing on first boot.
ExecStartPre = "+${pkgs.coreutils}/bin/chown ${userName}:${userName} /run/hive"; ExecStartPre = "+${pkgs.coreutils}/bin/chown -R ${userName}:${userName} /run/hive";
# Same drop-from-root as agent-base.nix (#658). Manager # Same drop-from-root as agent-base.nix (#658). Manager
# interactions with the host (rebuild approvals, config # interactions with the host (rebuild approvals, config
# writes) still happen via the dedicated unix sockets # writes) still happen via the dedicated unix sockets