vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(947): trim prose in lifecycle.rs socket-dir block

Browse source
This commit is contained in:
damocles 2026-06-01 16:46:07 +02:00 • committed by mara
commit eb108f9dd8
1 changed files with 10 additions and 38 deletions
Download patch file Download diff file Expand all files Collapse all files

48
hive-c0re/src/lifecycle.rs
View file

@ -1175,53 +1175,24 @@ fn set_nspawn_flags(
let _ = write!(binds, " --bind-ro={config_dir}:/agents/{agent_name}/config"); let _ = write!(binds, " --bind-ro={config_dir}:/agents/{agent_name}/config");
} }
// Web-socket subdir: bind-mount `/run/hive-agent/<name>/` into the
// Per-agent socket subdir for the web UI. Bind-mounts // container so the harness can bind `web.sock` there and the host-side
// `/run/hive-agent/<name>/` into the container at the same path so // gateway sees it. Subdir bind (not socket file) keeps the inode
// the harness's `HIVE_WEB_SOCKET` bind has a stable location both // visible after the harness unlinks a stale socket on rebind.
// sides can see. Applies to both manager and sub-agents — the manager // Applies to manager and sub-agents alike.
// has its own per-agent web UI (terminal, inbox, stats) that routes
// through the gateway just like sub-agents.
//
// Bind-mounting the SUBDIR (not the socket file) is mandatory:
// the harness's `bind_unix` helper unlinks any stale socket
// before calling `bind(2)`, and a file bind-mount drops its
// host-side anchor on unlink — the rebind would land in the
// container's private namespace, invisible to the gateway.
// Dir bind keeps the same dir inode visible on both sides, so
// the new `web.sock` shows up on the host the moment the
// harness binds it.
//
// Per-agent dir (rather than a shared `/run/hive-agent/` mount)
// means each container only sees its own subdir — never siblings'.
// See `docs/gateway.md::Per-agent unix-socket upstream`.
//
// mkdir source defensively: nspawn refuses to start when the
// bind source is missing, and on a fresh host `/run/hive-agent/`
// doesn't exist yet.
let socket_dir = crate::agent_sockets::agent_dir_for(agent_name); let socket_dir = crate::agent_sockets::agent_dir_for(agent_name);
std::fs::create_dir_all(&socket_dir) std::fs::create_dir_all(&socket_dir)
.with_context(|| format!("create {}", socket_dir.display()))?; .with_context(|| format!("create {}", socket_dir.display()))?;
// chown to the in-container agent user so its harness can // Chown to the agent user so the non-root harness can bind(2) here.
// `bind(2)` web.sock here. `create_dir_all` lands the dir at // Falls back to 0777 on first spawn when uid lookup returns None
// 0755 root:root and the harness runs as the non-root agent // (container /etc/passwd not yet rendered).
// user; without this chown the bind fails with EACCES, the
// gateway's agent-sockets.json stays empty, and the agent
// looks unreachable. uid resolution can return None on the
// very first spawn (container's /etc/passwd not yet rendered)
// — fall back to a permissive 0777 in that window so the
// first harness boot still binds. nspawn shares uids with the
// host (no PrivateUsers), so the in-container uid is the same
// uid we chown to here.
if let Some((uid, gid)) = agent_uid_gid(agent_name) { if let Some((uid, gid)) = agent_uid_gid(agent_name) {
std::os::unix::fs::chown(&socket_dir, Some(uid), Some(gid)) std::os::unix::fs::chown(&socket_dir, Some(uid), Some(gid))
.with_context(|| format!("chown {} to {uid}:{gid}", socket_dir.display()))?; .with_context(|| format!("chown {} to {uid}:{gid}", socket_dir.display()))?;
} else { } else {
use std::os::unix::fs::PermissionsExt; use std::os::unix::fs::PermissionsExt;
std::fs::set_permissions(&socket_dir, std::fs::Permissions::from_mode(0o777)) std::fs::set_permissions(&socket_dir, std::fs::Permissions::from_mode(0o777))
.with_context(|| { .with_context(|| format!("chmod 0777 {}", socket_dir.display()))?;
format!("chmod 0777 {} (uid lookup failed)", socket_dir.display())
})?;
} }
let _ = write!( let _ = write!(
binds, binds,
@ -1469,3 +1440,4 @@ mod tests {
); );
} }
} }