69 lines
3.4 KiB
Markdown
69 lines
3.4 KiB
Markdown
---
|
|
topic: what runs on it
|
|
status: accepted
|
|
date: 2026-09-21
|
|
deciders: jochen
|
|
reconstructed: false
|
|
extends: 02-DECISIONS/0051-shared-data-is-the-operators.md
|
|
---
|
|
|
|
# 91. A mount is declared, and there are three things it can be
|
|
|
|
## Context
|
|
|
|
A container's bind mount whose source does not exist is created by the container runtime, as
|
|
root, with whatever mode it picks. So `owner` and `mode` — which exist so a module can say who
|
|
its data belongs to — never reach the directories that hold data, and the rule that keeps a
|
|
directory when a module goes away ([ADR 0030](0030-data-outlives-the-mesh-that-declared-it.md))
|
|
does not cover them, because the mesh has never heard of them
|
|
([issue 026](../04-ISSUES/026-the-data-directories-are-not-declared/00-report.md)). Fourteen
|
|
such mounts were declared by hand; a check that every mount is declared was then written and
|
|
withdrawn, because it refused the builder: the builder mounts the container runtime's socket,
|
|
which is not its data, already exists, and belongs to the machine. Declaring it as the module's
|
|
own directory would be a lie the host would act on.
|
|
|
|
## Considered Options
|
|
|
|
1. **Declare the socket as a directory anyway.** Rejected: the host would create, own and
|
|
protect a path that is the machine's.
|
|
2. **A new manifest field** naming machine paths a module may mount. Rejected: the manifest
|
|
already says the module needs the container runtime, and a second field would say the same
|
|
thing in paths.
|
|
3. **Three declarations, one for each kind of path a mount can be.** Adopted.
|
|
|
|
## Decision
|
|
|
|
A container may not mount a path the module never declared, and a path is declared in one of
|
|
three ways, which are the three things a path can be:
|
|
|
|
- **the module's own** — a directory or file resource, or where a secret, a grant or a
|
|
contribution lands. Created and owned by the mesh for this module, kept when the module goes;
|
|
- **the operator's** — an `accesses` entry ([ADR 0051](0051-shared-data-is-the-operators.md)):
|
|
pre-existing, shared, granted for use, never owned;
|
|
- **the machine's** — a facility a declared capability grants. `container-runtime` grants its
|
|
socket. The path exists, the machine owns it, and the capability is the declaration.
|
|
|
|
A mount under a declared directory is declared. The check runs where the manifest is parsed,
|
|
and names the path and the three remedies.
|
|
|
|
## Consequences
|
|
|
|
Every directory that holds a module's data is one the mesh created with the module's owner and
|
|
mode, and one ADR 0030 protects. What got harder: a manifest borrowed from a compose file no
|
|
longer passes on the strength of its volume lines; each must say what kind of path it mounts.
|
|
The table of what a capability grants is small and in the catalogue's parser; a new capability
|
|
that grants a path adds a row.
|
|
|
|
## How it is checked
|
|
|
|
Manifest tests refuse an undeclared mount, accept one under a declared directory, accept one
|
|
the module accesses, and accept the runtime's socket with the capability and refuse it without.
|
|
A test parses every manifest in the catalogue beside the checkout and fails on any that breaks
|
|
the rule, so the catalogue cannot drift back.
|
|
|
|
## References
|
|
|
|
- [issue 026](../04-ISSUES/026-the-data-directories-are-not-declared/00-report.md)
|
|
- [ADR 0030](0030-data-outlives-the-mesh-that-declared-it.md), [ADR 0051](0051-shared-data-is-the-operators.md)
|
|
- [`03-DESIGN/01-to-be/18-building-a-module.md`](../03-DESIGN/01-to-be/18-building-a-module.md)
|