vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

run agent containers on an ephemeral root, salvaging the old one first

Browse source 
hive-priv copies a stopped container's root to the agent's work dir and
renames it aside before passing nspawn --ephemeral; the agent's nix state
moves to the persistent profiles bind. Adds the agent-ephemeral-rootfs vm
test and a module-eval case for the nix state redirect.
This commit is contained in:
atlas 2026-10-28 19:15:26 +01:00 • committed by mara
commit 81439fa710
1 changed files with 1238 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

13
nix/module-eval/agent-user.nix
View file

@ -25,6 +25,8 @@ let
migrate =
(agentWith { services.hyperhive.agent.user.name = "iris"; })
.system.activationScripts.hive-agent-user-migrate.text;
# The tmpfiles rules of the same named agent.
rules = (agentWith { services.hyperhive.agent.user.name = "iris"; }).systemd.tmpfiles.rules;
cases = [
{
# hive-c0re creates the host work dir as hive-core; this activation is
@ -63,6 +65,17 @@ let
lib.hasInfix ''if [ -L "$socketDir" ] || { [ -e "$socketDir" ] && [ ! -d "$socketDir" ]; }; then'' migrate
&& lib.hasInfix ''elif [ -d "$socketDir" ]; then'' migrate;
}
{
# The container root is rebuilt at every start; nix keeps a non-root
# user's profile in the home, so these rules are the only thing that puts
# it in the persistent per-container profiles bind. The `d` and `L` rules
# are each other's control: a misspelled path in one still finds the other.
name = "the agent's tmpfiles rules keep nix's per-user state in the persistent profiles bind";
ok =
lib.elem "d /nix/var/nix/profiles/per-user/iris 0755 iris iris - -" rules
&& lib.elem "L /home/iris/.local/state/nix - - - - /nix/var/nix/profiles/per-user/iris" rules
&& lib.elem "L /home/iris/.nix-profile - - - - /home/iris/.local/state/nix/profiles/profile" rules;
}
];
in
runGroup "agent-user" cases