Take a root-made directory in the mesh's own tree, and hold a container until the file it mounts exists (issue 1873) #131

Merged

mesh-tools merged 3 commits from fix/1873-mesh-tree-dirs into main 2026-10-22 20:41:09 +00:00

Conversation 2 Commits 3 Files Changed 6

+339

3 Commits

Author	SHA1	Message	Date
jschoubben	0d12fb11a4	Make no container before a file it mounts is there, and clear the empty directory a runtime left at a file's path (issue 1873) ... On ace the postgres container was replaced at 22:11:51 mounting superuser.secret, a file the provisioner's client fills only after the apply. The runtime made the missing source a directory, and every fill after it failed with "is a directory". A container whose mount source is a file the declaration declares, not yet on the machine, now waits and is neither created nor replaced. The write of that file (WriteFilled) applies what reads it, as before, so the container is made once the file is there. What the runtime already left is cured by the mesh: a declared file whose path is an empty directory in the mesh's own tree (by its path and by where it leads), owned by the engine's account, has that directory removed before the file is written, and the outcome says so. A directory with anything in it, or outside the tree, is never removed.	2026-10-22 22:29:39 +02:00
jschoubben	03b9c47af4	Judge the mesh's tree by where a path leads, not only by its text (issue 1873, review) ... A root-only link inside /var/lib/mesh pointing out of it would have made a directory outside the tree, owned by the engine's account, the mesh's to give away: the fault of issue 1873 again. The path and the tree's root are now both resolved, links followed, and the directory is the tree's only when the resolved path lies below the resolved root as well.	2026-10-22 22:27:45 +02:00
jschoubben	cdbff1777e	Take a directory in the mesh's own tree that the engine's account owns as the mesh's, not as found (issue 1873) ... postgres's data directory moved to /var/lib/mesh/postgres. On ace and novox that directory was there, root:root 0700, before the directory resource was applied, so the engine used it as found (issue 339's rule) and left it to root: the postgres provider, running as the operator's account, cannot reach its own secrets, consumers and grants there. /var/lib/mesh is the engine's tree (root, 0755): only the engine's account makes a directory in it. A directory below it owned by that account is now the mesh's and is given its declared owner and mode. Anywhere else, or owned by another account, issue 339's rule stands.	2026-10-22 22:23:04 +02:00