44 lines
1.8 KiB
Nix
44 lines
1.8 KiB
Nix
# The pre-start check of a container's root, for every `container@` instance.
|
|
#
|
|
# nixpkgs' start script runs as host root against the container's own root,
|
|
# which is persistent and writable by the container, and its `mkdir`, `chmod`,
|
|
# `touch` and `cp` follow links the container planted there. A drop-in on the
|
|
# `container@` template runs `hive-priv check-rootfs %i` as an `ExecStartPre=`
|
|
# before the script (`hive-priv/src/prestart.rs` has the rules). It covers the
|
|
# agents' imperative instances and the declarative ones (hive-forge,
|
|
# hive-matrix, the swarm services), each of which has a unit file of its own:
|
|
# systemd reads the template's drop-in directory for every instance.
|
|
#
|
|
# Order: systemd parses a drop-in after the unit file, so this line follows the
|
|
# unit file's own `ExecStartPre=` (nixpkgs' `preStart`, which touches no path
|
|
# under the root), and `ExecStart=` runs only after every `ExecStartPre=`
|
|
# succeeded.
|
|
#
|
|
# The drop-in is a unit-file package rather than `systemd.services."container@"`
|
|
# because that attribute renders the template's own unit file, which a
|
|
# declarative instance's unit file replaces.
|
|
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
dropin = pkgs.writeTextFile {
|
|
name = "hyperhive-container-rootfs-check";
|
|
destination = "/lib/systemd/system/container@.service.d/10-hyperhive-rootfs-check.conf";
|
|
text = ''
|
|
[Service]
|
|
ExecStartPre=${config.services.hyperhive.c0re.package}/bin/hive-priv check-rootfs %i
|
|
'';
|
|
};
|
|
in
|
|
{
|
|
config = lib.mkIf config.boot.enableContainers {
|
|
systemd.packages = [ dropin ];
|
|
|
|
# The per-agent drop-ins this check replaced rooted a hive-priv build per
|
|
# agent here. Boot is the one time no such drop-in is loaded.
|
|
systemd.tmpfiles.rules = [ "R! /nix/var/nix/gcroots/hyperhive-check-rootfs - - - - -" ];
|
|
};
|
|
}
|