红尘
d73ff9b0fb
Deploy Site / deploy-vercel (push) Has been cancelled
Deploy Site / deploy-docs (push) Has been cancelled
Docker / shell lint / Lint Dockerfile (hadolint) (push) Has been cancelled
Docker / shell lint / Lint docker/ shell scripts (shellcheck) (push) Has been cancelled
Docker Build and Publish / build-amd64 (push) Has been cancelled
Docker Build and Publish / build-arm64 (push) Has been cancelled
Lint (ruff + ty) / ruff + ty diff (push) Has been cancelled
Lint (ruff + ty) / ruff enforcement (blocking) (push) Has been cancelled
Lint (ruff + ty) / Windows footguns (blocking) (push) Has been cancelled
Nix Lockfile Fix / auto-fix-main (push) Has been cancelled
Nix Lockfile Fix / fix (push) Has been cancelled
Nix / nix (macos-latest) (push) Has been cancelled
Nix / nix (ubuntu-latest) (push) Has been cancelled
OSV-Scanner / Scan lockfiles (push) Has been cancelled
Build Skills Index / build-index (push) Has been cancelled
Tests / test (1) (push) Has been cancelled
Tests / test (2) (push) Has been cancelled
Tests / test (3) (push) Has been cancelled
Tests / test (4) (push) Has been cancelled
Tests / test (5) (push) Has been cancelled
Tests / test (6) (push) Has been cancelled
Tests / e2e (push) Has been cancelled
uv.lock check / uv lock --check (push) Has been cancelled
Docker Build and Publish / merge (push) Has been cancelled
Build Skills Index / trigger-deploy (push) Has been cancelled
Tests / save-durations (push) Has been cancelled
47 lines
2.1 KiB
Plaintext
Executable File
47 lines
2.1 KiB
Plaintext
Executable File
#!/command/with-contenv sh
|
|
# shellcheck shell=sh
|
|
# Container-boot reconciliation of per-profile gateway s6 services.
|
|
#
|
|
# Runs as root after 01-hermes-setup (the stage2 hook) has chowned
|
|
# the volume and seeded $HERMES_HOME, but before s6-rc starts user
|
|
# services. /etc/cont-init.d/* scripts run in lexicographic order,
|
|
# so the `02-` prefix guarantees ordering.
|
|
#
|
|
# Service directories under /run/service/ live on tmpfs and are
|
|
# wiped on every container restart. Profile directories under
|
|
# $HERMES_HOME/profiles/ live on the persistent VOLUME. This script
|
|
# walks the persistent profiles, recreates the s6 service slots,
|
|
# and auto-starts only those whose last recorded state was
|
|
# `running` — see hermes_cli/container_boot.py.
|
|
#
|
|
# Phase 4 also needs hermes-user writes to /run/service/ (so the
|
|
# profile create/delete hooks can register/unregister at runtime),
|
|
# so we chown the scandir before invoking the reconciler. We
|
|
# additionally chown the s6-svscan control FIFO so the hermes user
|
|
# can send rescan signals via ``s6-svscanctl -a``; without this the
|
|
# entire runtime-registration path is inert under UID 10000 (the
|
|
# Python wrapper catches the resulting EACCES, prints a warning,
|
|
# and swallows the failure).
|
|
set -e
|
|
|
|
# Make the dynamic scandir hermes-writable. The directory itself
|
|
# starts root-owned by s6-overlay.
|
|
chown hermes:hermes /run/service 2>/dev/null || true
|
|
|
|
# Make the svscan control FIFO hermes-writable so s6-svscanctl -a
|
|
# / -an work for the hermes user. The FIFO is created by s6-svscan
|
|
# at PID-1 startup, so by the time this cont-init.d script runs it
|
|
# already exists. Both ``control`` and ``lock`` need to be writable
|
|
# for the various svscanctl operations; the directory itself stays
|
|
# root-owned (we only need to touch the two FIFOs/locks inside).
|
|
if [ -d /run/service/.s6-svscan ]; then
|
|
for entry in control lock; do
|
|
if [ -e "/run/service/.s6-svscan/$entry" ]; then
|
|
chown hermes:hermes "/run/service/.s6-svscan/$entry" 2>/dev/null || true
|
|
fi
|
|
done
|
|
fi
|
|
|
|
exec s6-setuidgid hermes /opt/hermes/.venv/bin/python -m hermes_cli.container_boot
|
|
|