vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

ignore a failed warn-only root check: prefix its ExecStartPre with a dash

Browse source
This commit is contained in:
atlas 2026-10-28 23:52:37 +01:00
commit e0d2350902
1 changed files with 32 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

29
nix/module-eval/core-toggle.nix
View file

@ -1526,7 +1526,7 @@ let
carries =
m: name:
checks m name == [
(builtins.unsafeDiscardStringContext "${m.services.hyperhive.c0re.package}/bin/hive-priv check-rootfs --warn-only ${name}")
(builtins.unsafeDiscardStringContext "-${m.services.hyperhive.c0re.package}/bin/hive-priv check-rootfs --warn-only ${name}")
];
names = lib.attrNames allLocal.containers;
in
@ -1552,6 +1552,33 @@ let
# Control: a name with no unit finds nothing.
&& checks allLocal "swarm-nope" == [ ];
}
{
# Advisory means the start goes on whatever the check does, a crash or a
# missing binary included: systemd ignores the failure of a command
# prefixed `-`. The agents' strict line is the opposite and has no
# prefix; hive-priv renders it at runtime, and its own test
# (`the_rootfs_check_leads_the_service_section_…`) pins the bare
# `ExecStartPre=` there.
name = "every hyperhive container's root check is ignored on failure, not left to fail the start";
ok =
let
hivePrivLines =
m: name:
builtins.filter (lib.hasInfix "hive-priv") (
map (p: builtins.unsafeDiscardStringContext (toString p)) (
m.systemd.services."container@${name}".serviceConfig.ExecStartPre or [ ]
)
);
allLines = m: lib.concatMap (hivePrivLines m) (lib.attrNames m.containers);
ignored = lib.hasPrefix "-/";
in
allLines allLocal != [ ]
&& lib.length (allLines allLocal) == lib.length (lib.attrNames allLocal.containers)
&& lib.all ignored (allLines allLocal)
&& lib.all ignored (allLines withCi)
# Control: the test discriminates, a line without the prefix is not ignored.
&& !(ignored "/nix/store/x-hyperhive/bin/hive-priv check-rootfs --warn-only x");
}
{
# The operator's other containers are not hyperhive's to touch: a
# `containers.<name>` it declares gets no check, while the classifier