vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

docs: move privsep socket-activation + child-state rw rationale out of code comments

Browse source
This commit is contained in:
damocles 2026-06-08 20:04:05 +02:00 • committed by mara
commit fb1f7efbe4
4 changed files with 40 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

22
hive-c0re/src/lifecycle.rs
View file

@ -1100,18 +1100,10 @@ const HOST_META_ROOT: &str = "/var/lib/hyperhive/meta";
const HOST_SHARED_ROOT: &str = "/var/lib/hyperhive/shared";
/// Append bind flags for `child`'s state, harness, and config dirs into
/// `binds`. All three are RW so the parent can read/write state and
/// submit config-change requests. Creates missing host-side directories
/// so nspawn doesn't refuse to start; missing dirs are non-fatal.
/// Mount a child agent's `state`, `harness`, and `config` dirs into the
/// parent, all read-write. The RW on `state` is deliberate (not just a
/// read mount): a parent manages its children, which includes writing
/// into a child's state for recovery (e.g. seeding notes / clearing a
/// stuck sentinel) as well as reading it. `config` is RW because the
/// parent authors proposed config changes for the child (the approval
/// flow commits into the child's config repo). `harness` is RW for the
/// same management reasons. Per-child isolation still holds: a child
/// only ever has its *own* dirs bind-mounted, never a sibling's.
/// `binds`, all read-write. The RW on `state` is deliberate (recovery),
/// not an oversight; see docs/persistence.md ("Parent access to child
/// state") for the rationale. Creates missing host-side directories so
/// nspawn doesn't refuse to start; missing dirs are non-fatal.
fn bind_child_agent_dirs(child: &str, binds: &mut Vec<BindMount>) {
let state_dir = format!("{HOST_AGENTS_ROOT}/{child}/state");
let harness_dir = format!("{HOST_AGENTS_ROOT}/{child}/harness");
@ -1229,9 +1221,9 @@ async fn set_nspawn_flags(
});
// Topology-driven child mounts: every direct child of this agent gets
// its state, harness, and config dirs bind-mounted RW so the parent
// can read AND write child state (recovery) and manage its config.
// See `bind_child_agent_dirs` for why state is RW, not read-only.
// its state, harness, and config dirs bind-mounted RW (parent reads +
// writes child state for recovery, and manages config). See
// `bind_child_agent_dirs`.
let direct_children = crate::topology::children_of(agent_name);
for child in &direct_children {
bind_child_agent_dirs(child, &mut binds);