vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

hive-priv, hive-c0re: link docs/network.md instead of restating it

Browse source 
The network-isolation doc comments carried prose docs/network.md
already owns, and three of them named `harness-base.nix` — a file
that does not exist. The `hyperhive-isolated-dns` oneshot lives in
nix/agent-modules/network.nix, which the doc gets right.

That is #3749's argument reproducing itself: the same fact written
in two places goes stale in the copy nobody reads. Linking removes
the class, not just the instance — a link cannot name a nonexistent
file without the doc noticing first.

Trap and measurement comments stay put, per the issue's scope: the
load-bearing HOST_ADDRESS default-route note, the unquoted
$EXTRA_NSPAWN_FLAGS expansion, and the "isolation is the only mode"
invariants are facts about this code, not about the subsystem.
This commit is contained in:
atlas 2026-08-30 03:52:55 +02:00 • committed by mara
commit e56fc97be8
3 changed files with 20 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

23
hive-priv/src/main.rs
View file

@ -2759,10 +2759,9 @@ fn write_nspawn_flags(
// setup is skipped, so this only affects the container's route —
// exactly what we want.
let _ = writeln!(out, "HOST_ADDRESS={}", iso.gateway_ip);
// LOCAL_ADDRESS is intentionally empty: agent containers receive their
// IP dynamically via DHCP from the bridge dnsmasq pool. HOST_ADDRESS
// (the gateway IP) is still written so nixos-container's container-side
// init installs a default route before the DHCP lease arrives.
// LOCAL_ADDRESS is intentionally empty: containers take their IP by
// DHCP from the bridge dnsmasq pool. (Why HOST_ADDRESS is still
// written: the comment directly above.)
out.push_str("LOCAL_ADDRESS=\n");
out.push_str("HOST_ADDRESS6=\n");
out.push_str("LOCAL_ADDRESS6=\n");
@ -2790,15 +2789,13 @@ fn write_nspawn_flags(
let _ = writeln!(out, "EXTRA_NSPAWN_FLAGS=\"{flags_joined}\"");
std::fs::write(&path, out).with_context(|| format!("write {path}"))?;
// DNS marker for the in-container resolver oneshot. nixos-container
// copies the *host's* /etc/resolv.conf into the container at every
// start (its host resolver — e.g. 127.0.0.53 — is unreachable from a
// private netns, and isn't authoritative for the hive's own zones
// anyway). The `hyperhive-isolated-dns` oneshot in harness-base.nix
// rewrites resolv.conf to point at the bridge resolver, but only when
// this marker exists; it carries the gateway IP so the container
// doesn't have to re-derive it. Always written — every container is
// isolated, so there is no mode in which the marker should be absent.
// DNS marker for the in-container resolver oneshot: the oneshot only
// rewrites the container's resolv.conf when this marker exists, and the
// marker carries the gateway IP so the container need not re-derive it.
// Always written — every container is isolated, so there is no mode in
// which the marker should be absent. Why the rewrite is needed at all,
// and which unit does it: `docs/network.md` § *How the isolated
// container gets its resolver*.
write_bridge_dns_marker(container, isolation)?;
Ok(())
}