New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
nixos/nomad: enforce specific data_dir semantics #109768
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Left a few thoughts. Ignore the StateDirectory
comment... I read this commit by commit 😄
c6ab4a8
to
8b816ba
Compare
…lation to data_dir
ebefd44
to
c7c3b9e
Compare
@aanderse Is this okay to merge? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM 👍
I'll defer to @lovesegfault for merge, preferably, though. I'm not a nomad
user.
Roger that! Thanks. |
Motivation for this change
This PR enforces the semantics discussed here: #105739 (comment)
In summary, the
data_dir
value of the nomad service must be set toa specific value if
dropPrivileges
is set totrue
.The updated unit also includes additional documentation describing
the responsibilities of the nomad cluster manager given these
constraints as well as a suggestion for how to go about satisfying them.
Things done
sandbox
innix.conf
on non-NixOS linux)nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
./result/bin/
)nix path-info -S
before and after)