jochen
f515d8b6b2
Ten graduated and two abandoned efforts still said active, so the record read as open questions that later ADRs and designs had answered. Each now names in became: what decided or overtook it. To-be 45's undecided item moves from research 017 to issue 409, and research 037's shell follow-up is issue 410.
5.0 KiB
status, initiated, touches, became
| status | initiated | touches | became | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| graduated | 2026-10-04 |
|
|
027 — The system layer as modules
What is investigated
What runs on the machines below the operator's home and outside the mesh's own services, and which of it should be modules. That covers:
- the container runtime and its tools;
- privilege (sudo);
- the package manager and the software it cannot install;
- time, locale, the kernel and boot;
- log rotation;
- the machine-specific daemons the workstations and servers carry: printing, bluetooth, VPN clients, virtualisation, storage, sharing.
Why
The operator asked for the system level beside the graphical session. In particular:
- a
dockermodule (decided in principle by the proposed ADRs 0165 and 0166, never built); - a
docker-composemodule for development work, assigned only to the two workstations.
Measured in 01: on four machines, almost nothing at this level is owned by a module. The pieces differ by machine for no recorded reason. Three findings are security matters on their own.
How it is approached
Adopting is also improving (the operator, 2026-10-04). A module is not a copy of what a machine does today. Making it is the moment to fix what is broken, drop what is dead, choose the better tool and remove the leftovers. Every module's design lists its improvements over today. Every module also serves tools, many of them, for reading, acting and diagnosing; a module that only places a package and a file is unfinished. The tools are catalogued in 026/05.
What it touches
- The container runtime seat (ADRs 0165 and 0166, both proposed).
- The host's
packageshape, which installs from the distribution's official repositories only, while the workstations carry 67 and 114 packages from elsewhere. - How a secret reaches the account's environment. ADR 0203 forbids it in the contributed environment, but a predecessor file supplies such secrets today.
- The facts the mesh assumes and never declares, above all that the operator account escalates without a prompt.
Documents
- 01 — What the machines run: evidence.
- 02 — Candidates and questions
- 03 — The account's own tools:
~/.sshas one module's, scripts on every machine, the keyring, the laptop's power management, mail as events - The predecessor's lessons, shared with research 026: 026/03
What it became
Closed 2026-10-10. The container runtime is a node seat (ADR 0165, ADR 0166); software the distribution does not package ships as a pinned archive of its module (ADR 0205); a module depends on the node seats that apply its resources (ADR 0207); power and the machine's message bus are seats (ADR 0211, ADR 0215). The order and the remaining modules are to-be 42; the parts of the container-runtime records not yet built are tracked by issue 398.