vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

feat(#14): network isolation rust side — PRIVATE_NETWORK + veth wiring in set_nspawn_flags

Browse source
This commit is contained in:
damocles 2026-05-31 21:06:07 +02:00 • committed by mara
commit 3bb07b1fde
4 changed files with 185 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

23
hive-sh4re/src/priv_proto.rs
View file

@ -55,6 +55,17 @@ pub struct BindMount {
pub read_only: bool,
}
/// Network isolation parameters for `WriteNspawnFlags`. When `Some`,
/// hive-priv writes `PRIVATE_NETWORK=1` + veth bridge wiring instead
/// of the default `PRIVATE_NETWORK=0`.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct NetworkIsolation {
/// Static IP address to assign to this container on the bridge subnet.
pub agent_ip: String,
/// Host bridge interface name (e.g. `hive0`).
pub bridge: String,
}
/// A request to the privileged helper.
///
/// Wire format: one JSON object per line over `/run/hive/priv.sock`.
@ -128,12 +139,18 @@ pub enum PrivRequest {
},
// --- Config file writes ---
/// Update `/etc/nixos-containers/<container>.conf`: strip network-isolation
/// vars, force `PRIVATE_NETWORK=0`, and set `EXTRA_NSPAWN_FLAGS` from the
/// provided bind-mount list. Written by `lifecycle::set_nspawn_flags`.
/// Update `/etc/nixos-containers/<container>.conf`: strip old network-isolation
/// vars, write `PRIVATE_NETWORK` + bridge settings, and set `EXTRA_NSPAWN_FLAGS`
/// from the provided bind-mount list. Written by `lifecycle::set_nspawn_flags`.
/// When `isolation` is `Some`, writes `PRIVATE_NETWORK=1` + veth wiring;
/// when `None`, writes `PRIVATE_NETWORK=0`.
WriteNspawnFlags {
container: String,
binds: Vec<BindMount>,
/// `None` = host netns (PRIVATE_NETWORK=0). `Some` = private netns with
/// veth on the specified bridge (PRIVATE_NETWORK=1).
#[serde(default)]
isolation: Option<NetworkIsolation>,
},
/// Write `/run/systemd/system/container@<container>.service.d/hyperhive-limits.conf`