34 lines
1.6 KiB
Nix
34 lines
1.6 KiB
Nix
# The pre-start check of a container's root, for one of hyperhive's own
|
|
# declarative containers.
|
|
#
|
|
# nixpkgs' start script runs as host root against the container's own root,
|
|
# which is persistent and writable by the container, and its `mkdir`, `chmod`,
|
|
# `touch` and `cp` follow links the container planted there. `hive-priv
|
|
# check-rootfs` looks at the paths the script touches (rules in
|
|
# `hive-priv/src/prestart.rs`). With `--warn-only` it logs each violation at
|
|
# warning level and lets the start go on. The line carries systemd's `-`
|
|
# prefix, so a crash or a failed exec of the check cannot fail the start either.
|
|
# The agent containers run it strict
|
|
# from their per-agent drop-in (hive-priv's `WriteResourceLimits`).
|
|
#
|
|
# Pure function, not a NixOS module. A container's module calls it with its
|
|
# own name and folds the result into its unit:
|
|
#
|
|
# rootfsCheck = import ./lib/container-rootfs-check.nix { inherit config; };
|
|
# # systemd.services."container@${machine}" = lib.mkMerge [ (rootfsCheck.warnOnly machine) … ];
|
|
#
|
|
# The name list is the callers', never `config.containers`: that also holds
|
|
# containers the operator runs that hyperhive doesn't own, and those get
|
|
# nothing. nixpkgs renders each declarative container as its own
|
|
# `container@<name>` unit (`nixos-containers.nix`, the `mapAttrsToList` that
|
|
# builds `container@${name}`), so a setting on that unit reaches that
|
|
# container only.
|
|
{ config }:
|
|
{
|
|
# Attributes for `systemd.services."container@<name>"`.
|
|
warnOnly = name: {
|
|
serviceConfig.ExecStartPre = [
|
|
"-${config.services.hyperhive.deploy.hive-controller.package}/bin/hive-priv check-rootfs --warn-only ${name}"
|
|
];
|
|
};
|
|
}
|