vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

check every container's root before its start, through the container@ template

Browse source
This commit is contained in:
atlas 2026-10-28 23:15:03 +01:00
commit c191975aab
1 changed files with 179 additions and 339 deletions
Download patch file Download diff file Expand all files Collapse all files

9
hive-priv-sock/src/lib.rs
View file

@ -369,11 +369,7 @@ pub enum PrivRequest {
/// Write `/run/systemd/system/container@<container>.service.d/hyperhive-limits.conf`
/// with `[Service]` carrying `MemoryMax=` / `CPUQuota=` (hard caps) and
/// `CPUWeight=` / `IOWeight=` (cgroup v2 relative shares, contention-only),
/// and an `ExecStartPre=` that runs `hive-priv check-rootfs <container>`
/// to refuse a start over a root with links where the start script
/// expects directories. The build that line names is rooted under
/// `/nix/var/nix/gcroots/hyperhive-check-rootfs/<container>`.
/// `CPUWeight=` / `IOWeight=` (cgroup v2 relative shares, contention-only).
/// Written by `lifecycle::set_resource_limits`.
WriteResourceLimits {
container: String,
@ -392,8 +388,7 @@ pub enum PrivRequest {
io_weight: Option<u32>,
},
/// Remove `/run/systemd/system/container@<container>.service.d/` if present,
/// and the GC root of the hive-priv build its `ExecStartPre=` named.
/// Remove `/run/systemd/system/container@<container>.service.d/` if present.
/// Called by `lifecycle::destroy` to clean up the resource-limits drop-in.
RemoveServiceDropin { container: String },