ADRs 0091 and 0092; issues 026 and 070 resolved; designs 18 and 24 amended

2026-09-21 17:50:41 +02:00
parent ffb7fa52ec
commit 16442ecd23
9 changed files with 183 additions and 8 deletions
@@ -0,0 +1,68 @@
+---
+topic: what runs on it
+status: accepted
+date: 2026-09-21
+deciders: jochen
+reconstructed: false
+extends: 02-DECISIONS/0051-shared-data-is-the-operators.md
+---
+
+# 91. A mount is declared, and there are three things it can be
+
+## Context
+
+A container's bind mount whose source does not exist is created by the container runtime, as
+root, with whatever mode it picks. So `owner` and `mode` — which exist so a module can say who
+its data belongs to — never reach the directories that hold data, and the rule that keeps a
+directory when a module goes away ([ADR 0030](0030-data-outlives-the-mesh-that-declared-it.md))
+does not cover them, because the mesh has never heard of them
+([issue 026](../04-ISSUES/026-the-data-directories-are-not-declared/00-report.md)). Fourteen
+such mounts were declared by hand; a check that every mount is declared was then written and
+withdrawn, because it refused the builder: the builder mounts the container runtime's socket,
+which is not its data, already exists, and belongs to the machine. Declaring it as the module's
+own directory would be a lie the host would act on.
+
+## Considered Options
+
+1. **Declare the socket as a directory anyway.** Rejected: the host would create, own and
+   protect a path that is the machine's.
+2. **A new manifest field** naming machine paths a module may mount. Rejected: the manifest
+   already says the module needs the container runtime, and a second field would say the same
+   thing in paths.
+3. **Three declarations, one for each kind of path a mount can be.** Adopted.
+
+## Decision
+
+A container may not mount a path the module never declared, and a path is declared in one of
+three ways, which are the three things a path can be:
+
+- **the module's own** — a directory or file resource, or where a secret, a grant or a
+  contribution lands. Created and owned by the mesh for this module, kept when the module goes;
+- **the operator's** — an `accesses` entry ([ADR 0051](0051-shared-data-is-the-operators.md)):
+  pre-existing, shared, granted for use, never owned;
+- **the machine's** — a facility a declared capability grants. `container-runtime` grants its
+  socket. The path exists, the machine owns it, and the capability is the declaration.
+
+A mount under a declared directory is declared. The check runs where the manifest is parsed,
+and names the path and the three remedies.
+
+## Consequences
+
+Every directory that holds a module's data is one the mesh created with the module's owner and
+mode, and one ADR 0030 protects. What got harder: a manifest borrowed from a compose file no
+longer passes on the strength of its volume lines; each must say what kind of path it mounts.
+The table of what a capability grants is small and in the catalogue's parser; a new capability
+that grants a path adds a row.
+
+## How it is checked
+
+Manifest tests refuse an undeclared mount, accept one under a declared directory, accept one
+the module accesses, and accept the runtime's socket with the capability and refuse it without.
+A test parses every manifest in the catalogue beside the checkout and fails on any that breaks
+the rule, so the catalogue cannot drift back.
+
+## References
+
+- [issue 026](../04-ISSUES/026-the-data-directories-are-not-declared/00-report.md)
+- [ADR 0030](0030-data-outlives-the-mesh-that-declared-it.md), [ADR 0051](0051-shared-data-is-the-operators.md)
+- [`03-DESIGN/01-to-be/18-building-a-module.md`](../03-DESIGN/01-to-be/18-building-a-module.md)