vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

run the root check warn-only on hyperhive's own containers, per unit, not on the container@ template

Browse source
This commit is contained in:
atlas 2026-10-28 23:37:59 +01:00
commit 24afc89ab3
1 changed files with 707 additions and 172 deletions
Download patch file Download diff file Expand all files Collapse all files

9
hive-priv-sock/src/lib.rs
View file

@ -369,7 +369,11 @@ pub enum PrivRequest {
/// Write `/run/systemd/system/container@<container>.service.d/hyperhive-limits.conf`
/// with `[Service]` carrying `MemoryMax=` / `CPUQuota=` (hard caps) and
/// `CPUWeight=` / `IOWeight=` (cgroup v2 relative shares, contention-only).
/// `CPUWeight=` / `IOWeight=` (cgroup v2 relative shares, contention-only),
/// and an `ExecStartPre=` that runs `hive-priv check-rootfs <container>`
/// to refuse a start over a root with links where the start script
/// expects directories. The build that line names is rooted under
/// `/nix/var/nix/gcroots/hyperhive-check-rootfs/<container>`.
/// Written by `lifecycle::set_resource_limits`.
WriteResourceLimits {
container: String,
@ -388,7 +392,8 @@ pub enum PrivRequest {
io_weight: Option<u32>,
},
/// Remove `/run/systemd/system/container@<container>.service.d/` if present.
/// Remove `/run/systemd/system/container@<container>.service.d/` if present,
/// and the GC root of the hive-priv build its `ExecStartPre=` named.
/// Called by `lifecycle::destroy` to clean up the resource-limits drop-in.
RemoveServiceDropin { container: String },