vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

hive-priv, hive-c0re: link docs/network.md instead of restating it

Browse source 
The network-isolation doc comments carried prose docs/network.md
already owns, and three of them named `harness-base.nix` — a file
that does not exist. The `hyperhive-isolated-dns` oneshot lives in
nix/agent-modules/network.nix, which the doc gets right.

That is #3749's argument reproducing itself: the same fact written
in two places goes stale in the copy nobody reads. Linking removes
the class, not just the instance — a link cannot name a nonexistent
file without the doc noticing first.

Trap and measurement comments stay put, per the issue's scope: the
load-bearing HOST_ADDRESS default-route note, the unquoted
$EXTRA_NSPAWN_FLAGS expansion, and the "isolation is the only mode"
invariants are facts about this code, not about the subsystem.
This commit is contained in:
atlas 2026-08-30 03:52:55 +02:00 • committed by mara
commit e56fc97be8
3 changed files with 20 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

10
hive-priv-sock/src/lib.rs
View file

@ -294,9 +294,8 @@ pub struct CredentialMount {
/// Network isolation parameters for `WriteNspawnFlags`. hive-priv writes
/// `PRIVATE_NETWORK=1` + veth bridge wiring from these; every container
/// is isolated, so they are required rather than a mode selector.
/// Containers receive their IP
/// dynamically via DHCP from the bridge dnsmasq pool (`networking.useDHCP`
/// in `harness-base.nix`); no static address is pre-assigned here.
/// No static address is pre-assigned here — see `docs/network.md`
/// § *Container isolation* for how a container gets its address.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct NetworkIsolation {
/// Host bridge interface name (e.g. `hive0`).
@ -306,9 +305,8 @@ pub struct NetworkIsolation {
/// container-side setup installs a default route (`default via <gw>`)
/// before DHCP completes: without it the container has no route off
/// the bridge subnet until the DHCP lease arrives. The same IP runs the
/// hive dnsmasq resolver, so it's also written into the container's
/// `/etc/resolv.conf` (see the isolated-DNS oneshot in `harness-base.nix`,
/// gated on the marker hive-priv drops).
/// hive dnsmasq resolver — see `docs/network.md` § *How the isolated
/// container gets its resolver*.
pub gateway_ip: String,
}