vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

hive-priv, hive-c0re: link docs/network.md instead of restating it

Browse source 
The network-isolation doc comments carried prose docs/network.md
already owns, and three of them named `harness-base.nix` — a file
that does not exist. The `hyperhive-isolated-dns` oneshot lives in
nix/agent-modules/network.nix, which the doc gets right.

That is #3749's argument reproducing itself: the same fact written
in two places goes stale in the copy nobody reads. Linking removes
the class, not just the instance — a link cannot name a nonexistent
file without the doc noticing first.

Trap and measurement comments stay put, per the issue's scope: the
load-bearing HOST_ADDRESS default-route note, the unquoted
$EXTRA_NSPAWN_FLAGS expansion, and the "isolation is the only mode"
invariants are facts about this code, not about the subsystem.
This commit is contained in:
atlas 2026-08-30 03:52:55 +02:00 • committed by mara
commit e56fc97be8
3 changed files with 20 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

12
hive-c0re/src/lifecycle/host_config.rs
View file

@ -131,12 +131,12 @@ fn bind_child_agent_dirs(child: &str, binds: &mut Vec<BindMount>) {
}
/// Idempotently rewrite the lines in `/etc/nixos-containers/<container>.conf`
/// that hive-c0re owns: `PRIVATE_NETWORK` (always 1 — every container runs in
/// its own network namespace with a veth on the host bridge, and the agent's
/// web UI is reached over that bridge rather than a host-shared netns),
/// `HOST_ADDRESS` (the bridge gateway IP, so the container installs a default
/// route before DHCP completes) and `EXTRA_NSPAWN_FLAGS` (the runtime-dir
/// bind). The start script expands `$EXTRA_NSPAWN_FLAGS` unquoted into the
/// that hive-c0re owns: `PRIVATE_NETWORK` (always 1), `HOST_ADDRESS` (the
/// bridge gateway IP) and `EXTRA_NSPAWN_FLAGS` (the runtime-dir bind). What
/// those network vars mean and why isolation is unconditional:
/// `docs/network.md` § *What the Rust side does*.
///
/// ⚠️ The start script expands `$EXTRA_NSPAWN_FLAGS` unquoted into the
/// `systemd-nspawn` command.
#[allow(
clippy::too_many_lines,

10
hive-priv-sock/src/lib.rs
View file

@ -294,9 +294,8 @@ pub struct CredentialMount {
/// Network isolation parameters for `WriteNspawnFlags`. hive-priv writes
/// `PRIVATE_NETWORK=1` + veth bridge wiring from these; every container
/// is isolated, so they are required rather than a mode selector.
/// Containers receive their IP
/// dynamically via DHCP from the bridge dnsmasq pool (`networking.useDHCP`
/// in `harness-base.nix`); no static address is pre-assigned here.
/// No static address is pre-assigned here — see `docs/network.md`
/// § *Container isolation* for how a container gets its address.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct NetworkIsolation {
/// Host bridge interface name (e.g. `hive0`).
@ -306,9 +305,8 @@ pub struct NetworkIsolation {
/// container-side setup installs a default route (`default via <gw>`)
/// before DHCP completes: without it the container has no route off
/// the bridge subnet until the DHCP lease arrives. The same IP runs the
/// hive dnsmasq resolver, so it's also written into the container's
/// `/etc/resolv.conf` (see the isolated-DNS oneshot in `harness-base.nix`,
/// gated on the marker hive-priv drops).
/// hive dnsmasq resolver — see `docs/network.md` § *How the isolated
/// container gets its resolver*.
pub gateway_ip: String,
}

23
hive-priv/src/main.rs
View file

@ -2759,10 +2759,9 @@ fn write_nspawn_flags(
// setup is skipped, so this only affects the container's route —
// exactly what we want.
let _ = writeln!(out, "HOST_ADDRESS={}", iso.gateway_ip);
// LOCAL_ADDRESS is intentionally empty: agent containers receive their
// IP dynamically via DHCP from the bridge dnsmasq pool. HOST_ADDRESS
// (the gateway IP) is still written so nixos-container's container-side
// init installs a default route before the DHCP lease arrives.
// LOCAL_ADDRESS is intentionally empty: containers take their IP by
// DHCP from the bridge dnsmasq pool. (Why HOST_ADDRESS is still
// written: the comment directly above.)
out.push_str("LOCAL_ADDRESS=\n");
out.push_str("HOST_ADDRESS6=\n");
out.push_str("LOCAL_ADDRESS6=\n");
@ -2790,15 +2789,13 @@ fn write_nspawn_flags(
let _ = writeln!(out, "EXTRA_NSPAWN_FLAGS=\"{flags_joined}\"");
std::fs::write(&path, out).with_context(|| format!("write {path}"))?;
// DNS marker for the in-container resolver oneshot. nixos-container
// copies the *host's* /etc/resolv.conf into the container at every
// start (its host resolver — e.g. 127.0.0.53 — is unreachable from a
// private netns, and isn't authoritative for the hive's own zones
// anyway). The `hyperhive-isolated-dns` oneshot in harness-base.nix
// rewrites resolv.conf to point at the bridge resolver, but only when
// this marker exists; it carries the gateway IP so the container
// doesn't have to re-derive it. Always written — every container is
// isolated, so there is no mode in which the marker should be absent.
// DNS marker for the in-container resolver oneshot: the oneshot only
// rewrites the container's resolv.conf when this marker exists, and the
// marker carries the gateway IP so the container need not re-derive it.
// Always written — every container is isolated, so there is no mode in
// which the marker should be absent. Why the rewrite is needed at all,
// and which unit does it: `docs/network.md` § *How the isolated
// container gets its resolver*.
write_bridge_dns_marker(container, isolation)?;
Ok(())
}