Pass a container's groups to the runtime as supplementary groups and report container-groups (issue 1637, ADR 0480 clause 7) #127

2026-10-21T14:08:00Z

mesh-tools commented

2026-10-21 14:08:00 +00:00

Fixes issue 1637 (R4d: a container names supplementary groups). The node-engine reads a container's groups, passes each to the runtime as a supplementary group, and reports the container-groups capability. mesh-sdk is pinned to the merge of #60 (85b5a26), which holds a module that names groups off a node that does not report the capability. Rebased onto main after #126 (issue 1695): both the file-references and the container-groups capabilities are in internal/profile/detectors.go.

Try build-1792590074119078150 passed on ef30c12 (41 s); d9f8bbec differs from it only by the mesh-sdk pin.

Reviewed-by: reviewer-r4dg@shanks at d9f8bbec0c

Fixes issue 1637 (R4d: a container names supplementary groups). The node-engine reads a container's `groups`, passes each to the runtime as a supplementary group, and reports the `container-groups` capability. mesh-sdk is pinned to the merge of #60 (85b5a26), which holds a module that names groups off a node that does not report the capability. Rebased onto main after #126 (issue 1695): both the file-references and the container-groups capabilities are in internal/profile/detectors.go. Try build-1792590074119078150 passed on ef30c12 (41 s); d9f8bbec differs from it only by the mesh-sdk pin. Reviewed-by: reviewer-r4dg@shanks at d9f8bbec0c0bc10d8c767c04ca69ad84e75832aa

mesh-tools added 2 commits 2026-10-21 14:08:00 +00:00

Pass a container's groups to the runtime as supplementary groups and report container-groups (issues 1637, ADR 0480 clause 7) ef30c12291

mesh-sdk is pinned to feat/r4d-groups f0f66d5b8d42 (mesh-sdk #58) until it merges.

Pin mesh-sdk to the merge of #60 (container-groups capability)

mesh/repo-check head d9f8bbec0c0b merged into trunk fd3259a3f5d7 beside mesh-controller#422@2aa291f3 — pass: its merge-check.sh passed

Details

mesh/merge-gate head d9f8bbec0c0b merged into trunk fd3259a3f5d7 — pass: group feat/r4d-groups composed: every machine composes with the change as it did w…

Details

mesh/delivery delivered

Details

mesh/delivery-group group feat/r4d-groups delivered: every member is delivered

Details

d9f8bbec0c

mesh-tools commented

2026-10-21 14:12:06 +00:00

Delivery novox/mesh-host@d9f8bbec0c0b — delivered since 2026-10-21T15:35:19Z

Delivery plan — builds mesh-host → ace, g14, novox, shanks; no bus step

tier 0: mesh-host
ace: receives mesh-host
g14: receives mesh-host
novox: receives mesh-host
shanks: receives mesh-host
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine

Group feat/r4d-groups: novox/mesh-controller@2aa291f3b3, novox/mesh-host@d9f8bbec0c

composed together: pass — every machine composes with the change as it did without (4 of 4 compose)

Machines

mesh-host on every machine running it: sent
mesh-controller on every machine running it: sent
build-agent on every machine running it: sent

Transitions

2026-10-21 14:11 (new) → proposed (announced): novox/mesh-host#127's head announced
2026-10-21 14:20 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
2026-10-21 14:20 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-21 15:23 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-21 15:23 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
2026-10-21 15:35 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-host@d9f8bbec0c0b` — **delivered** since 2026-10-21T15:35:19Z **Delivery plan** — builds mesh-host → ace, g14, novox, shanks; no bus step - tier 0: mesh-host - ace: receives mesh-host - g14: receives mesh-host - novox: receives mesh-host - shanks: receives mesh-host - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine **Group** `feat/r4d-groups`: novox/mesh-controller@2aa291f3b30b, novox/mesh-host@d9f8bbec0c0b - composed together: pass — every machine composes with the change as it did without (4 of 4 compose) **Machines** - mesh-host on every machine running it: sent - mesh-controller on every machine running it: sent - build-agent on every machine running it: sent **Transitions** - 2026-10-21 14:11 (new) → proposed (announced): novox/mesh-host#127's head announced - 2026-10-21 14:20 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-21 14:20 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-21 15:23 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-21 15:23 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-21 15:35 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-tools merged commit 7e83137aa8 into main

2026-10-21 14:45:04 +00:00

mesh-tools deleted branch feat/r4d-groups

2026-10-21 14:45:04 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-host#127