vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

priv: WriteNspawnFlags takes Vec<BindMount> instead of raw flag strings

Browse source
This commit is contained in:
damocles 2026-06-01 17:22:09 +02:00 • committed by mara
commit c9eb520e7c
3 changed files with 38 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

17
hive-sh4re/src/priv_proto.rs
View file

@ -22,6 +22,16 @@ pub const SIBLING_CONTAINERS: &[&str] = &["hive-forge", "hive-matrix", "hive-gat
/// `{META_DIR}#{name}`, derived by `hive-priv` — never passed over the wire.
pub const META_DIR: &str = "/var/lib/hyperhive/meta";
/// One bind-mount entry for `WriteNspawnFlags`.
/// hive-priv constructs `--bind=<host_path>:<container_path>` (or `--bind-ro=`)
/// and validates both paths before writing the conf file.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct BindMount {
pub host_path: String,
pub container_path: String,
pub read_only: bool,
}
/// A request to the privileged helper.
///
/// Wire format: one JSON object per line over `/run/hive/priv.sock`.
@ -59,10 +69,9 @@ pub enum PrivRequest {
// --- Config file writes ---
/// Update `/etc/nixos-containers/<container>.conf`: strip network-isolation
/// vars, force `PRIVATE_NETWORK=0`, and set `EXTRA_NSPAWN_FLAGS`.
/// Each entry in `extra_nspawn_flags` is one flag (e.g. `"--bind=/path"`);
/// hive-priv validates and space-joins them. Written by `lifecycle::set_nspawn_flags`.
WriteNspawnFlags { container: String, extra_nspawn_flags: Vec<String> },
/// vars, force `PRIVATE_NETWORK=0`, and set `EXTRA_NSPAWN_FLAGS` from the
/// provided bind-mount list. Written by `lifecycle::set_nspawn_flags`.
WriteNspawnFlags { container: String, binds: Vec<BindMount> },
/// Write `/run/systemd/system/container@<container>.service.d/hyperhive-limits.conf`
/// with `[Service]\nMemoryMax=<memory_max>\nCPUQuota=<cpu_quota>\n`.