From c557f99cba45db7ed3c09a157be19289ad0f4981 Mon Sep 17 00:00:00 2001 From: jochen Date: Thu, 27 Aug 2026 23:59:05 +0200 Subject: [PATCH] Record what testing podman actually showed 0060 said the container runtime was a separate decision. It is now made, and the reasoning is worth keeping because it is the opposite answer to the same question one paragraph earlier. Abstracting service managers is lossy -- systemd and OpenRC are different models and LoadState has no equivalent. Container runtimes converged on one CLI deliberately, so almost nothing is lost: checked against podman 6.1.0, run, rm -f and docker's own template syntax for state and labels all work unchanged. Only the probe differs. So: a two-entry lookup, not an interface. The difference that is NOT in the CLI is the one that would have shipped silently. Podman accepts --restart unless-stopped, records it, and has no daemon to act on it -- containers do not return after a reboot unless podman-restart.service is enabled, which by default it is not. Every command reports success and the effect does not happen. That belongs in the declaration rather than the host: a node using podman is told to enable the unit. Which is what made the service shape's missing 'boot' field visible, and it is now built. --- ...-the-host-is-built-per-operating-system.md | 21 ++++++++++++++++--- 03-DESIGN/01-to-be/05-the-node-host.md | 3 ++- 2 files changed, 20 insertions(+), 4 deletions(-) diff --git a/02-DECISIONS/0060-the-host-is-built-per-operating-system.md b/02-DECISIONS/0060-the-host-is-built-per-operating-system.md index 83c79ee..40c8d99 100644 --- a/02-DECISIONS/0060-the-host-is-built-per-operating-system.md +++ b/02-DECISIONS/0060-the-host-is-built-per-operating-system.md @@ -89,9 +89,24 @@ broken one. host ships as a package from the mesh's own repository ([ADR 0058](0058-delivery-ends-in-a-declaration.md)), and a `.pkg.tar.zst` is an Arch artifact. A per-OS binary is consistent with what was already decided rather than an addition to it. -- **The container runtime is left unresolved on purpose**, because it is not an OS split: Arch - runs docker or podman. Per-OS hosts answer the service and package managers and leave the - runtime a genuine choice *within* a host. That is a separate decision. +- **The container runtime is a choice within a host, not an OS split** — Arch runs docker or + podman — and it is **detected, not declared**, because adoption keeps what the machine already + has. Two are supported. + + This is the opposite answer to the one above, for a reason rather than by preference. + Abstracting service managers is *lossy*: systemd and OpenRC are different models, and + `LoadState` has no equivalent. Container runtimes deliberately converged on one CLI, so almost + nothing is lost — checked against podman 6.1.0, `run`, `rm -f` and docker's own template + syntax for reading state and labels all work unchanged. **Only the probe differs** + (`{{.ServerVersion}}` against `{{.Version.Version}}`), which makes it a two-entry lookup + rather than an interface. + + **One difference is not in the CLI and would have shipped silently.** Podman accepts + `--restart unless-stopped` and records it, and has no daemon to act on it: containers do not + come back after a reboot unless `podman-restart.service` is enabled, which it is not by + default. Every command reports success and the effect does not happen. That belongs in the + **declaration** — a node using podman is told to enable that unit — rather than in the host, + which keeps the host dumb and puts the difference where a person can read it. - **A second operating system is now additive rather than a redesign** — write two appliers, ship a package. And it will be designed against a real machine rather than a guess, which is the point of not building the abstraction now. diff --git a/03-DESIGN/01-to-be/05-the-node-host.md b/03-DESIGN/01-to-be/05-the-node-host.md index 78dd62d..4f0af0f 100644 --- a/03-DESIGN/01-to-be/05-the-node-host.md +++ b/03-DESIGN/01-to-be/05-the-node-host.md @@ -272,7 +272,8 @@ Raising the substrate needs six shapes in the host's vocabulary, and **all six a | | | | |---|---|---| -| `directory`, `file`, `service` | **built** | the first three | +| `directory`, `file` | **built** | no machine dependency at all | +| `service` | **built** | running/stopped **and** enabled/disabled at boot — a unit started but not enabled stops being true at the next reboot | | `package` | **built** | present, never upgraded, and **never uninstalled** — the host cannot know what else needs it, so dropping one is *forgotten*, not *removed* | | `container` | **built** | pinned by digest ([ADR 0046](../../02-DECISIONS/0046-the-installer-fetches-what-it-pins.md)); identified by a label carrying a digest of the declaration that made it, because a runtime normalises what it is given and that is indistinguishable from drift | | `action` | **built** | bundle-only ([ADR 0047](../../02-DECISIONS/0047-the-bundle-may-carry-actions-the-link-may-not.md)); verify is mandatory and is the idempotency check as well as the read-back |