vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

remove the /shared bind from agent containers

Browse source
This commit is contained in:
atlas 2026-10-26 21:33:04 +01:00
commit 7dd5d30da8
1 changed files with 52 additions and 71 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/trust-boundary/boundary.md
View file

@ -145,9 +145,7 @@ would require opening a netns anyway.
see [`docs/trust-boundary/security.md`](security.md#hive-c0re-privilege-separation) for
how `PrivRequest::ReloadGatewayNginx`'s containment works.
⚠️ Contrast `/shared`, which _is_ sticky world-writable (`1777`): it has
many legitimate writers, so sticky is the best available answer there.
This dir has exactly one writer, so it needs no world write at all.
⚠️ This dir has exactly one writer, so it needs no world write at all.
### host admin socket access (`hivectl`)