3.4 KiB
topic, status, date, deciders, reconstructed, extends
| topic | status | date | deciders | reconstructed | extends |
|---|---|---|---|---|---|
| what runs on it | accepted | 2026-09-21 | jochen | false | 02-DECISIONS/0051-shared-data-is-the-operators.md |
91. A mount is declared, and there are three things it can be
Context
A container's bind mount whose source does not exist is created by the container runtime, as
root, with whatever mode it picks. So owner and mode — which exist so a module can say who
its data belongs to — never reach the directories that hold data, and the rule that keeps a
directory when a module goes away (ADR 0030)
does not cover them, because the mesh has never heard of them
(issue 026). Fourteen
such mounts were declared by hand; a check that every mount is declared was then written and
withdrawn, because it refused the builder: the builder mounts the container runtime's socket,
which is not its data, already exists, and belongs to the machine. Declaring it as the module's
own directory would be a lie the host would act on.
Considered Options
- Declare the socket as a directory anyway. Rejected: the host would create, own and protect a path that is the machine's.
- A new manifest field naming machine paths a module may mount. Rejected: the manifest already says the module needs the container runtime, and a second field would say the same thing in paths.
- Three declarations, one for each kind of path a mount can be. Adopted.
Decision
A container may not mount a path the module never declared, and a path is declared in one of three ways, which are the three things a path can be:
- the module's own — a directory or file resource, or where a secret, a grant or a contribution lands. Created and owned by the mesh for this module, kept when the module goes;
- the operator's — an
accessesentry (ADR 0051): pre-existing, shared, granted for use, never owned; - the machine's — a facility a declared capability grants.
container-runtimegrants its socket. The path exists, the machine owns it, and the capability is the declaration.
A mount under a declared directory is declared. The check runs where the manifest is parsed, and names the path and the three remedies.
Consequences
Every directory that holds a module's data is one the mesh created with the module's owner and mode, and one ADR 0030 protects. What got harder: a manifest borrowed from a compose file no longer passes on the strength of its volume lines; each must say what kind of path it mounts. The table of what a capability grants is small and in the catalogue's parser; a new capability that grants a path adds a row.
How it is checked
Manifest tests refuse an undeclared mount, accept one under a declared directory, accept one the module accesses, and accept the runtime's socket with the capability and refuse it without. A test parses every manifest in the catalogue beside the checkout and fails on any that breaks the rule, so the catalogue cannot drift back.