The node-engine reports whether an unprivileged user can make a user namespace (design 47 R4a, issue 1308) #123

Merged

mesh-tools merged 1 commits from feat/r4a-sdk-first into main 2026-10-20 07:15:53 +00:00

Conversation 1 Commits 1 Files Changed 3

+222

mesh-tools commented 2026-10-20 07:08:41 +00:00

Member

Copy Link

Copy Source

Design 47 release R4a (ADR 0453 clause 1, ADR 0448 §5). Delivery group feat/r4a-sdk-first with mesh-sdk.

internal/profile gains the capability user-namespaces: as root the probe drops to uid/gid 65534 first (setpriv --reuid=65534 --regid=65534 --clear-groups unshare --user true), since root can always make one; otherwise unshare --user true. Absent, the detail carries the command's words and the kernel settings (unprivileged_userns_clone, max_user_namespaces). The build modules of R4c require it (ADR 0448 §5), so it is reported first.

Tests: internal/profile userns_test.go (AC1-AC4, each seen failing first). Try build-1792479016474015631 passed. AC5 is live: mesh-controller.node shows the capability on each build node after delivery.

Reviewed-by: review-r4a@shanks at 64dfa90c3a

Design 47 release R4a (ADR 0453 clause 1, ADR 0448 §5). Delivery group feat/r4a-sdk-first with mesh-sdk. internal/profile gains the capability `user-namespaces`: as root the probe drops to uid/gid 65534 first (`setpriv --reuid=65534 --regid=65534 --clear-groups unshare --user true`), since root can always make one; otherwise `unshare --user true`. Absent, the detail carries the command's words and the kernel settings (unprivileged_userns_clone, max_user_namespaces). The build modules of R4c require it (ADR 0448 §5), so it is reported first. Tests: internal/profile userns_test.go (AC1-AC4, each seen failing first). Try build-1792479016474015631 passed. AC5 is live: mesh-controller.node shows the capability on each build node after delivery. Reviewed-by: review-r4a@shanks at 64dfa90c3a6c7a6cfa500f501aeb8b80d2bb4b34

mesh-tools added 1 commit 2026-10-20 07:08:42 +00:00

Report whether an unprivileged user namespace can be made (issue 1308) ... 64dfa90c3a

A build module's sandbox needs one, and a module can require only a capability the node-engine detects (ADR 0448 section 5). The probe drops to an unprivileged uid first when run as root, since root always can.

mesh-tools commented 2026-10-20 07:08:48 +00:00

Author

Member

Copy Link

Copy Source

Delivery novox/mesh-host@64dfa90c3a6c — delivered since 2026-10-20T07:45:58Z

Delivery plan — builds mesh-host → ace, g14, novox, shanks; no bus step

• tier 0: mesh-host
• ace: receives mesh-host
• g14: receives mesh-host
• novox: receives mesh-host
• shanks: receives mesh-host
• grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine

Group feat/r4a-sdk-first: novox/mesh-host@64dfa90c3a, novox/mesh-sdk@075bf1e1fe

• composed together: pass — every machine composes with the change as it did without (4 of 4 compose)

Machines

• mesh-host on every machine running it: sent
• mesh-sdk on every machine running it: sent
• mesh-tools on every machine running it: sent
• audit-logger on every machine running it: sent
• baserow on every machine running it: sent
• bazarr on every machine running it: sent
• bookshelf on every machine running it: sent
• confluence on every machine running it: sent
• gitea on every machine running it: sent
• gitlab on every machine running it: sent
• grafana on every machine running it: sent
• home-assistant on every machine running it: sent
• icecast on every machine running it: sent
• influxdb on every machine running it: sent
• jackett on every machine running it: sent
• jira on every machine running it: sent
• kometa on every machine running it: sent
• lab on every machine running it: sent
• letta on every machine running it: sent
• lidarr on every machine running it: sent
• mesh-catalog on every machine running it: sent
• model-usage on every machine running it: sent
• mosquitto on every machine running it: sent
• netcheck on every machine running it: sent
• nextcloud on every machine running it: sent
• nodered on every machine running it: sent
• ombi on every machine running it: sent
• openai-consumer on every machine running it: sent
• radarr on every machine running it: sent
• redis on every machine running it: sent
• route-adapter on every machine running it: sent
• searxng on every machine running it: sent
• showcase on every machine running it: sent
• sonarr on every machine running it: sent
• tautulli on every machine running it: sent
• umami on every machine running it: sent
• unifi on every machine running it: sent
• zsh on every machine running it: sent

Transitions

• 2026-10-20 07:08 (new) → proposed (announced): novox/mesh-host#123's head announced
• 2026-10-20 07:09 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
• 2026-10-20 07:09 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-20 07:17 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-20 07:17 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
• 2026-10-20 07:45 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-host@64dfa90c3a6c` — **delivered** since 2026-10-20T07:45:58Z **Delivery plan** — builds mesh-host → ace, g14, novox, shanks; no bus step - tier 0: mesh-host - ace: receives mesh-host - g14: receives mesh-host - novox: receives mesh-host - shanks: receives mesh-host - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine **Group** `feat/r4a-sdk-first`: novox/mesh-host@64dfa90c3a6c, novox/mesh-sdk@075bf1e1fe8f - composed together: pass — every machine composes with the change as it did without (4 of 4 compose) **Machines** - mesh-host on every machine running it: sent - mesh-sdk on every machine running it: sent - mesh-tools on every machine running it: sent - audit-logger on every machine running it: sent - baserow on every machine running it: sent - bazarr on every machine running it: sent - bookshelf on every machine running it: sent - confluence on every machine running it: sent - gitea on every machine running it: sent - gitlab on every machine running it: sent - grafana on every machine running it: sent - home-assistant on every machine running it: sent - icecast on every machine running it: sent - influxdb on every machine running it: sent - jackett on every machine running it: sent - jira on every machine running it: sent - kometa on every machine running it: sent - lab on every machine running it: sent - letta on every machine running it: sent - lidarr on every machine running it: sent - mesh-catalog on every machine running it: sent - model-usage on every machine running it: sent - mosquitto on every machine running it: sent - netcheck on every machine running it: sent - nextcloud on every machine running it: sent - nodered on every machine running it: sent - ombi on every machine running it: sent - openai-consumer on every machine running it: sent - radarr on every machine running it: sent - redis on every machine running it: sent - route-adapter on every machine running it: sent - searxng on every machine running it: sent - showcase on every machine running it: sent - sonarr on every machine running it: sent - tautulli on every machine running it: sent - umami on every machine running it: sent - unifi on every machine running it: sent - zsh on every machine running it: sent **Transitions** - 2026-10-20 07:08 (new) → proposed (announced): novox/mesh-host#123's head announced - 2026-10-20 07:09 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-20 07:09 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-20 07:17 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-20 07:17 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-20 07:45 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-tools merged commit cdcba9ca73 into main 2026-10-20 07:15:53 +00:00

mesh-tools deleted branch feat/r4a-sdk-first 2026-10-20 07:15:53 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

mesh/ready

Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)

No labels

Milestone

No items

No Milestone

Assignees

Clear assignees

agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-host#123