vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

run the platform containers' root check through a build-independent path

Browse source
This commit is contained in:
atlas 2026-10-30 11:13:16 +01:00
commit 29c57e058a
1 changed files with 34 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

5
docs/agent-lifecycle/persistence.md
View file

@ -418,7 +418,10 @@ until the next collection. A drop-in written by an older hive-priv has no
**Hyperhive's platform containers: warn only.** The forge, the matrix server and
the swarm services (15 containers, declared by their own modules) run the same
check as `hive-priv check-rootfs --warn-only <name>`, from `ExecStartPre=` on
their own `container@<name>` unit. It evaluates every rule, logs each violation
their own `container@<name>` unit, through the symlink `/run/hive-rootfs-check`
that `hive-priv.nix` points at the current build, so a new hyperhive build does
not change the unit or restart the container. It evaluates every rule, logs each
violation
as a warning, and exits 0, so the container starts either way. The line reads
`rootfs check (warn-only): <name>: <message>` with journald's warning priority.
Strict refusal needs the live roots of all 15 to pass first, and the warnings