root the build the pre-start check names

hive-priv/src/container_config.rs

@@ -74,13 +74,14 @@ pub(crate) fn validate_container_system_name(name: &str) -> Result<&str> {
 }
 
 /// `RemoveServiceDropin` — remove the container service's drop-in dir
-/// if present (idempotent).
+/// if present (idempotent), then the GC root of the build it named.
 pub(crate) fn remove_service_dropin(container: &str) -> Result<(String, String)> {
     validate_container_system_name(container)?;
     let dir = format!("/run/systemd/system/container@{container}.service.d");
     if Path::new(&dir).exists() {
         std::fs::remove_dir_all(&dir).with_context(|| format!("remove {dir}"))?;
     }
+    crate::prestart::unpin_binary(container)?;
     Ok((String::new(), String::new()))
 }
 
@@ -91,7 +92,9 @@ pub(crate) fn remove_service_dropin(container: &str) -> Result<(String, String)>
 /// The drop-in also carries the `ExecStartPre=` that runs
 /// `hive-priv check-rootfs <container>` ([`crate::prestart`]) ahead of
 /// nixpkgs' start script. It names this process's own binary, so the drop-in
-/// and the binary that implements the check are always the same build.
+/// and the binary that implements the check are always the same build. The
+/// build is rooted against garbage collection for as long as the drop-in
+/// names it ([`crate::prestart::pin_binary`]).
 ///
 /// Two different kinds of setting land in the same file. `MemoryMax=` /
 /// `CPUQuota=` are hard caps that throttle even on an idle host;
@@ -118,7 +121,11 @@ pub(crate) fn write_resource_limits(
     let dir = format!("/run/systemd/system/container@{container}.service.d");
     std::fs::create_dir_all(&dir).with_context(|| format!("create {dir}"))?;
     let path = format!("{dir}/hyperhive-limits.conf");
-    let rootfs_check = rootfs_check_command(container)?;
+    let exe = hive_priv_exe()?;
+    // Rooted before the drop-in names it, so the drop-in never names a build a
+    // collection can take.
+    crate::prestart::pin_binary(container, Path::new(&exe))?;
+    let rootfs_check = rootfs_check_command(&exe, container);
     let content = limits_dropin_body(
         &runtime_dir,
         &rootfs_check,
@@ -203,14 +210,13 @@ fn limits_dropin_body(
     )
 }
 
-/// The `ExecStartPre=` command of the pre-start root check for `container`:
-/// this binary's absolute path, then the sub-command and the name.
+/// This binary's absolute path, for the drop-in's `ExecStartPre=`.
 ///
 /// The path is the running binary's, not a fixed one, so a drop-in never names
 /// a build without the sub-command. systemd expands `%` and `$` in command
 /// lines and splits on spaces, so a path with any of them is refused rather
 /// than escaped; store paths never have them.
-fn rootfs_check_command(container: &str) -> Result<String> {
+fn hive_priv_exe() -> Result<String> {
     let exe = std::env::current_exe().context("resolve the hive-priv binary path")?;
     let exe = exe
         .to_str()
@@ -225,7 +231,13 @@ fn rootfs_check_command(container: &str) -> Result<String> {
                 exe.display()
             )
         })?;
-    Ok(format!("{exe} {} {container}", crate::prestart::SUBCOMMAND))
+    Ok(exe.to_owned())
+}
+
+/// The `ExecStartPre=` command of the pre-start root check for `container`:
+/// the binary `exe`, then the sub-command and the name.
+fn rootfs_check_command(exe: &str, container: &str) -> String {
+    format!("{exe} {} {container}", crate::prestart::SUBCOMMAND)
 }
 
 /// `DaemonReload` — `systemctl daemon-reload` on the host.
@@ -586,9 +598,9 @@ pub(crate) fn write_container_etc_file_in(rootfs: &Path, name: &str, contents: &
 mod tests {
     use super::{
         BindMount, HiveFacts, NetworkIsolation, git_overlay_flags, handle_write_nspawn_flags,
-        limits_dropin_body, nspawn_flags, publish_file, remove_service_dropin, render_hive_facts,
-        rootfs_check_command, validate_container_system_name, write_bridge_dns_marker_in,
-        write_resource_limits,
+        hive_priv_exe, limits_dropin_body, nspawn_flags, publish_file, remove_service_dropin,
+        render_hive_facts, rootfs_check_command, validate_container_system_name,
+        write_bridge_dns_marker_in, write_resource_limits,
     };
     use crate::shared::test_support::{entries, scratch};
 
@@ -748,7 +760,7 @@ mod tests {
     #[test]
     fn the_check_command_names_this_binary_the_subcommand_and_the_container() {
         let exe = std::env::current_exe().unwrap();
-        let cmd = rootfs_check_command("h-iris").unwrap();
+        let cmd = rootfs_check_command(&hive_priv_exe().unwrap(), "h-iris");
         assert_eq!(cmd, format!("{} check-rootfs h-iris", exe.display()));
         assert!(cmd.starts_with('/'), "{cmd}");
     }