vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

ignore a failed warn-only root check: prefix its ExecStartPre with a dash

Browse source
This commit is contained in:
atlas 2026-10-28 23:52:37 +01:00
commit e0d2350902
2 changed files with 32 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
nix/host-modules/lib/container-rootfs-check.nix
View file

@ -6,7 +6,9 @@
# `touch` and `cp` follow links the container planted there. `hive-priv
# check-rootfs` looks at the paths the script touches (rules in
# `hive-priv/src/prestart.rs`). With `--warn-only` it logs each violation at
# warning level and lets the start go on; the agent containers run it strict
# warning level and lets the start go on. The line carries systemd's `-`
# prefix, so a crash or a failed exec of the check cannot fail the start either.
# The agent containers run it strict
# from their per-agent drop-in (hive-priv's `WriteResourceLimits`).
#
# Pure function, not a NixOS module. A container's module calls it with its
@ -26,7 +28,7 @@
# Attributes for `systemd.services."container@<name>"`.
warnOnly = name: {
serviceConfig.ExecStartPre = [
"${config.services.hyperhive.c0re.package}/bin/hive-priv check-rootfs --warn-only ${name}"
"-${config.services.hyperhive.c0re.package}/bin/hive-priv check-rootfs --warn-only ${name}"
];
};
}

29
nix/module-eval/core-toggle.nix
View file

@ -1526,7 +1526,7 @@ let
carries =
m: name:
checks m name == [
(builtins.unsafeDiscardStringContext "${m.services.hyperhive.c0re.package}/bin/hive-priv check-rootfs --warn-only ${name}")
(builtins.unsafeDiscardStringContext "-${m.services.hyperhive.c0re.package}/bin/hive-priv check-rootfs --warn-only ${name}")
];
names = lib.attrNames allLocal.containers;
in
@ -1552,6 +1552,33 @@ let
# Control: a name with no unit finds nothing.
&& checks allLocal "swarm-nope" == [ ];
}
{
# Advisory means the start goes on whatever the check does, a crash or a
# missing binary included: systemd ignores the failure of a command
# prefixed `-`. The agents' strict line is the opposite and has no
# prefix; hive-priv renders it at runtime, and its own test
# (`the_rootfs_check_leads_the_service_section_…`) pins the bare
# `ExecStartPre=` there.
name = "every hyperhive container's root check is ignored on failure, not left to fail the start";
ok =
let
hivePrivLines =
m: name:
builtins.filter (lib.hasInfix "hive-priv") (
map (p: builtins.unsafeDiscardStringContext (toString p)) (
m.systemd.services."container@${name}".serviceConfig.ExecStartPre or [ ]
)
);
allLines = m: lib.concatMap (hivePrivLines m) (lib.attrNames m.containers);
ignored = lib.hasPrefix "-/";
in
allLines allLocal != [ ]
&& lib.length (allLines allLocal) == lib.length (lib.attrNames allLocal.containers)
&& lib.all ignored (allLines allLocal)
&& lib.all ignored (allLines withCi)
# Control: the test discriminates, a line without the prefix is not ignored.
&& !(ignored "/nix/store/x-hyperhive/bin/hive-priv check-rootfs --warn-only x");
}
{
# The operator's other containers are not hyperhive's to touch: a
# `containers.<name>` it declares gets no check, while the classifier