vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

run agent containers on an ephemeral root, salvaging the old one first

Browse source 
hive-priv copies a stopped container's root to the agent's work dir and
renames it aside before passing nspawn --ephemeral; the agent's nix state
moves to the persistent profiles bind. Adds the agent-ephemeral-rootfs vm
test and a module-eval case for the nix state redirect.
This commit is contained in:
atlas 2026-10-28 19:15:26 +01:00 • committed by mara
commit 81439fa710
1 changed files with 1238 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

20
nix/agent-modules/user.nix
View file

@ -142,6 +142,26 @@ in
gid = config.services.hyperhive.agent.user.gid;
};
# nix keeps a non-root user's profile under `~/.local/state/nix`, and the
# root is rebuilt at every start. Redirecting that directory into the
# per-container `/nix/var/nix/profiles` bind keeps what the agent installs
# (profile generations and the GC roots that point at them) across restarts.
# `~/.nix-profile` is the link nix makes on first use; recreating it puts
# the profile's `bin/` back on PATH before nix runs again.
systemd.tmpfiles.rules =
let
persisted = "/nix/var/nix/profiles/per-user/${userName}";
owner = "${userName} ${userName}";
in
[
"d /nix/var/nix/profiles/per-user 0755 root root - -"
"d ${persisted} 0755 ${owner} - -"
"d ${homeDir}/.local 0755 ${owner} - -"
"d ${homeDir}/.local/state 0755 ${owner} - -"
"L ${homeDir}/.local/state/nix - - - - ${persisted}"
"L ${homeDir}/.nix-profile - - - - ${homeDir}/.local/state/nix/profiles/profile"
];
# `NOPASSWD: ALL` for the agent user. Lets claude's Bash tool
# keep working with anything that expected root (systemctl,
# nix-env, etc.) without prompting. Flip