vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

document the user namespace opt-in

Browse source
This commit is contained in:
atlas 2026-11-01 13:53:41 +01:00 • committed by mara
commit da098b1a50
1 changed files with 49 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/trust-boundary/boundary.md
View file

@ -119,8 +119,11 @@ both sockets are `0666`, which is all a dialer needs.
hive-priv creates the dir when missing (`EnsureAgentSocketDir`, `0751
root:root`, no symlink followed) and leaves an existing one alone. The
container's own activation (`hive-agent-user-migrate`) then chowns it to
the agent user and sets `0751`. The container has no user namespace, so
that uid is the host inode's owner. Don't add a host-side chown or chmod:
the agent user and sets `0751`. Without a user namespace
that uid is the host inode's owner. (A namespaced agent, see "User namespace" in
`docs/agent-lifecycle/persistence.md`, gets the dir from `EnsureAgentSocketDir`
owned by its data owner instead, because the container can't chown through
the id map.) Don't add another host-side chown or chmod:
two owners of one path revert each other. Until the container activates,
the dir is `0751 root`: nothing but root can plant a socket in it.