vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

check every container's root before its start, through the container@ template

Browse source
This commit is contained in:
atlas 2026-10-28 23:15:03 +01:00
commit c191975aab
1 changed files with 179 additions and 339 deletions
Download patch file Download diff file Expand all files Collapse all files

28
nix/vm-tests/agent-ephemeral-rootfs.nix
View file

@ -13,10 +13,10 @@
# forwarder (nix/agent-modules/otel.nix) reads it, and the host can read it;
# - a package installed into the user's nix profile is still there, and on
# PATH, after a restart;
# - a link planted at `root` in the template refuses the next start through
# the limits drop-in's `ExecStartPre=` check (whose build has a GC root),
# leaves the link's target untouched, and the start goes through once the
# link is gone.
# - a link planted at `root` in the root template refuses the next start through
# the `ExecStartPre=` check in the `container@` template drop-in
# (nix/host-modules/container-rootfs-check.nix), leaves the link's target
# untouched, and the start goes through once the link is gone.
#
# The agent's journal forwarder itself (an OTLP push to the hive's collector) is
# not booted here; the module-eval suite covers its wiring.
@ -69,6 +69,7 @@ pkgs.testers.runNixOSTest {
{
imports = [
hiveStubs
../host-modules/container-rootfs-check.nix
../host-modules/hive-priv.nix
];
virtualisation.memorySize = 2048;
@ -233,21 +234,10 @@ pkgs.testers.runNixOSTest {
with subtest("a link planted in the root refuses the start and nothing is touched"):
stop()
# What hive-c0re does besides WriteNspawnFlags: the limits drop-in,
# which carries the pre-start check, and the runtime dir its condition
# names.
host.succeed(f"mkdir -p /run/hyperhive/agents/{AGENT}")
for req in [
{"op": "write_resource_limits", "container": MACHINE, "memory_max": "1G", "cpu_quota": "200%"},
{"op": "daemon_reload"},
]:
out = host.succeed(f"echo '{json.dumps(req)}' | socat - UNIX-CONNECT:/run/hive/priv.sock")
assert json.loads(out.strip().splitlines()[-1])["ok"] is True, out
dropin = host.succeed(f"cat /run/systemd/system/container@{MACHINE}.service.d/hyperhive-limits.conf")
assert "ExecStartPre=/nix/store/" in dropin and f"check-rootfs {MACHINE}\n" in dropin, dropin
# The build the drop-in names is rooted against garbage collection.
build = "/".join(dropin.split("ExecStartPre=")[1].split()[0].split("/")[:4])
assert host.succeed(f"readlink /nix/var/nix/gcroots/hyperhive-check-rootfs/{MACHINE}").strip() == build, build
# The pre-start check is a drop-in of the `container@` template, so the
# unit carries it with no per-container drop-in written.
unit = host.succeed(f"systemctl cat container@{MACHINE}")
assert "bin/hive-priv check-rootfs %i\n" in unit, unit
# `root` is a link to a directory outside the root, which the start
# script would `chmod 0700` as host root.