vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

run the platform containers' root check through a build-independent path

Browse source
This commit is contained in:
atlas 2026-10-30 11:13:16 +01:00
commit 29c57e058a
1 changed files with 34 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

8
nix/host-modules/hive-priv.nix
View file

@ -9,13 +9,19 @@
}:
let
controllerCfg = config.services.hyperhive.deploy.hive-controller;
rootfsCheck = import ./lib/container-rootfs-check.nix { inherit config; };
in
{
config = lib.mkIf config.services.hyperhive.deploy.hive-controller.enable {
# The parent of every agent socket dir. hive-priv is its only writer
# (`EnsureAgentSocketDir`), and its unit lists it in `ReadWritePaths`,
# which fails the unit when the path is missing.
systemd.tmpfiles.rules = [ "d /run/hive-agent 0755 root root - -" ];
systemd.tmpfiles.rules = [
"d /run/hive-agent 0755 root root - -"
# The platform containers run their warn-only root check by this path
# (`lib/container-rootfs-check.nix`), so their units carry no store path.
"L+ ${rootfsCheck.hivePriv} - - - - ${controllerCfg.package}/bin/hive-priv"
];
# Socket unit for hive-priv — the narrow root helper that executes
# privileged operations on behalf of hive-c0re. Systemd creates and