frcc-kvm
master
@@ -326,0 +347,4 @@
for name in (n for n, ds in DEVICES.items() if ds):
host_ns = server.succeed("readlink /proc/1/ns/user").strip()
ct_ns = server.succeed(f"readlink /proc/{container_pid(name)}/ns/user").strip()
assert host_ns != ct_ns, f"{name} shares the host user namespace"
do asserts even trigger in python scripts by default? not confident this is the right mechanism
["example","server-n0"] /nix/store/prahsm2071cyy2ldx86qagz3s37prqzd-nixos-system-example-26.11.20260810.2fcb964 /nix/store/r49hifxa4385z2mc9lja51wqb92mr798-nixos-system-server-n0-26.11.20260810.2fcb964 ["example","server-n0"] /nix/store/prahsm2071cyy2ldx86qagz3s37prqzd-nixos-system-example-26.11.20260810.2fcb964 /nix/store/k6mfj88i62npmx2kh4w7zlcs3187qw06-nixos-system-server-n0-26.11.20260810.2fcb964
<<< /nix/store/prahsm2071cyy2ldx86qagz3s37prqzd-nixos-system-example-26.11.20260810.2fcb964 >>> /nix/store/prahsm2071cyy2ldx86qagz3s37prqzd-nixos-system-example-26.11.20260810.2fcb964 PATHS: 816 -> 816 (+0, -0) SIZE: 3.29 GiB -> 3.29 GiB DIFF: 0 bytes
<<< /nix/store/r49hifxa4385z2mc9lja51wqb92mr798-nixos-system-server-n0-26.11.20260810.2fcb964 >>> /nix/store/k6mfj88i62npmx2kh4w7zlcs3187qw06-nixos-system-server-n0-26.11.20260810.2fcb964 PATHS: 2308 -> 2308 (+16, -16) SIZE: 10.6 GiB -> 10.6 GiB DIFF: -128 bytes
["example","server-n0"] /nix/store/xqjyw5hlcl26mrgpfd0n75ps16j37iaf-inspect-example.json /nix/store/mnh8wz8xzrwajg89smc686g36yl5sa0m-inspect-server-n0.json ["example","server-n0"] /nix/store/xqjyw5hlcl26mrgpfd0n75ps16j37iaf-inspect-example.json /nix/store/iqqjkvzi5f7xnar9kgby0b8a9sfsz6xm-inspect-server-n0.json
@@ deployments @@ - ssh-generic.limits.privateUsers: pick + ssh-generic.limits.privateUsers: identity @@ units @@ @host.container@ssh-generic.service.script: @@ -119,7 +119,7 @@ --setenv HOST_PORT="${HOST_PORT-}" \ --setenv PATH="$PATH" \ \ - --capability="CAP_NET_ADMIN,CAP_MKNOD" \ + \ \ ${EXTRA_NSPAWN_FLAGS-} \ container-init "${SYSTEM_PATH:-/nix/var/nix/profiles/system}/init" - @host.container@ssh-generic.service.serviceConfig.DeviceAllow: - - /dev/vhost-net rw - @host.container@ssh-generic.service.serviceConfig.DeviceAllow: - - /dev/net/tun rwm - @host.container@ssh-generic.service.serviceConfig.DeviceAllow: - - /dev/net/tun rwm + @host.microvm@ci-runner.service.serviceConfig.DeviceAllow: []
9721112d67
1bf51e9a9e
49137f9c16
5ef48168f4
70d7eafe76
No dependencies set.
The note is not visible to the blocked user.
flowey
@@ -326,0 +347,4 @@for name in (n for n, ds in DEVICES.items() if ds):host_ns = server.succeed("readlink /proc/1/ns/user").strip()ct_ns = server.succeed(f"readlink /proc/{container_pid(name)}/ns/user").strip()assert host_ns != ct_ns, f"{name} shares the host user namespace"do asserts even trigger in python scripts by default? not confident this is the right mechanism
["example","server-n0"]
/nix/store/prahsm2071cyy2ldx86qagz3s37prqzd-nixos-system-example-26.11.20260810.2fcb964
/nix/store/r49hifxa4385z2mc9lja51wqb92mr798-nixos-system-server-n0-26.11.20260810.2fcb964
["example","server-n0"]
/nix/store/prahsm2071cyy2ldx86qagz3s37prqzd-nixos-system-example-26.11.20260810.2fcb964
/nix/store/k6mfj88i62npmx2kh4w7zlcs3187qw06-nixos-system-server-n0-26.11.20260810.2fcb964
System closure diff vs
masterexample
server-n0
["example","server-n0"]
/nix/store/xqjyw5hlcl26mrgpfd0n75ps16j37iaf-inspect-example.json
/nix/store/mnh8wz8xzrwajg89smc686g36yl5sa0m-inspect-server-n0.json
["example","server-n0"]
/nix/store/xqjyw5hlcl26mrgpfd0n75ps16j37iaf-inspect-example.json
/nix/store/iqqjkvzi5f7xnar9kgby0b8a9sfsz6xm-inspect-server-n0.json
Inspection diff vs
masterserver-n0
9721112d67to1bf51e9a9e49137f9c16to5ef48168f45ef48168f4to70d7eafe76