check every container's root before its start, through the container@ template

nix/host-modules/container-rootfs-check.nix

@@ -0,0 +1,44 @@
+# The pre-start check of a container's root, for every `container@` instance.
+#
+# nixpkgs' start script runs as host root against the container's own root,
+# which is persistent and writable by the container, and its `mkdir`, `chmod`,
+# `touch` and `cp` follow links the container planted there. A drop-in on the
+# `container@` template runs `hive-priv check-rootfs %i` as an `ExecStartPre=`
+# before the script (`hive-priv/src/prestart.rs` has the rules). It covers the
+# agents' imperative instances and the declarative ones (hive-forge,
+# hive-matrix, the swarm services), each of which has a unit file of its own:
+# systemd reads the template's drop-in directory for every instance.
+#
+# Order: systemd parses a drop-in after the unit file, so this line follows the
+# unit file's own `ExecStartPre=` (nixpkgs' `preStart`, which touches no path
+# under the root), and `ExecStart=` runs only after every `ExecStartPre=`
+# succeeded.
+#
+# The drop-in is a unit-file package rather than `systemd.services."container@"`
+# because that attribute renders the template's own unit file, which a
+# declarative instance's unit file replaces.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  dropin = pkgs.writeTextFile {
+    name = "hyperhive-container-rootfs-check";
+    destination = "/lib/systemd/system/container@.service.d/10-hyperhive-rootfs-check.conf";
+    text = ''
+      [Service]
+      ExecStartPre=${config.services.hyperhive.c0re.package}/bin/hive-priv check-rootfs %i
+    '';
+  };
+in
+{
+  config = lib.mkIf config.boot.enableContainers {
+    systemd.packages = [ dropin ];
+
+    # The per-agent drop-ins this check replaced rooted a hive-priv build per
+    # agent here. Boot is the one time no such drop-in is loaded.
+    systemd.tmpfiles.rules = [ "R! /nix/var/nix/gcroots/hyperhive-check-rootfs - - - - -" ];
+  };
+}

nix/host-modules/default.nix

@@ -22,6 +22,7 @@
     ./hive-matrix-service.nix
     ./hive-matrix.nix
     ./hive-network.nix
+    ./container-rootfs-check.nix
     ./hive-priv.nix
     ./hive-priv-cache.nix
     ./hive-squid.nix