vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: reframe stale 'the manager' as the root/bootstrap container (infra + web-ui)

Browse source 
Port-range, network-isolation, state-dir, web-UI-port, priv allowlist,
and rebuild-source mentions now refer to the root/bootstrap container
rather than 'the manager' — no structural manager exists (root-ness is
topological). Real artifact names (the manager.nix template toplevel,
/run/hyperhive/manager/mcp.sock) are left as-is.
This commit is contained in:
iris 2026-06-23 12:02:57 +02:00 • committed by mara
commit ec5c7d49c4
6 changed files with 13 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/network.md
View file

@ -130,7 +130,7 @@ address arithmetic.
`lifecycle::set_nspawn_flags` when creating or updating containers. Each
agent gets a deterministic IP derived from its name so the address is
reproducible across destroy/recreate. This applies uniformly to all
containers including the manager — no special case.
containers including the root/bootstrap container — no special case.
`HOST_ADDRESS` is the bridge gateway IP (the address part of
`HIVE_NETWORK_SUBNET`, via `lifecycle::bridge_gateway_ip` — taken verbatim
@ -163,9 +163,9 @@ wiring is runtime:
an instant no-op in shared-netns mode (the marker is absent, so
`ConditionPathExists` skips it).
**Why isolation is safe for the manager**: all hive-c0re communication goes
**Why isolation is safe for the root agent**: all hive-c0re communication goes
through unix domain sockets (`/run/hive/mcp.sock` for agent requests,
`/run/hive/priv.sock` for privileged ops, per-agent manager sockets).
`/run/hive/priv.sock` for privileged ops, per-agent privileged sockets).
These are bind-mounted into containers via the nspawn conf. UDS paths
traverse the VFS, not the network stack, so `PRIVATE_NETWORK=1` does not
affect them.