novox/mesh-lab
3
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

A builder that is a module cannot see the machine's filesystem

Browse Source 
It runs in a container, so a path like /root exists for the machine and not for
it. The first build in this test works because the hand-started builder runs on
the host; the second is done by the module, and asked it to clone a path it has
no way to reach.

A real module is cloned from the forge over a URL. The lab has no forge, so the
repository goes in the directory the module already mounts — the same fact
wearing different clothes.
This commit is contained in:
jschoubben
2026-08-31 01:53:22 +02:00
parent 83727099eb
commit f5619b02d6
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/integration/mesh.test.ts
+10 -4
View File
@@ -727,13 +727,19 @@ test("the builder is a module the mesh assigns, with a credential the mesh deliv
// And it works: the mesh asks this builder to build something, and it does. Answering is the // And it works: the mesh asks this builder to build something, and it does. Answering is the
// only proof that the delivered credential authenticates — a container that is up with a // only proof that the delivered credential authenticates — a container that is up with a
// credential it cannot use looks identical from outside. // credential it cannot use looks identical from outside.
await must("anchor", `mkdir -p /root/built && printf %s '{"module":"built","version":"1",` + // Somewhere the builder can actually see. A builder that is a module runs in a container, so
// the machine's filesystem is not its own — a path like /root only works for a builder somebody
// started on the host, which is what the first build above used. In a real mesh a module is
// cloned from the forge over a URL; here it goes in the directory the module already mounts,
// which is the same fact wearing different clothes.
const repo = "/var/lib/mesh/builder/repositories/built";
await must("anchor", `mkdir -p ${repo} && printf %s '{"module":"built","version":"1",` +
`"resources":[{"id":"marker","type":"file","path":"/etc/built","content":"yes","mode":"0644"}]}' ` + `"resources":[{"id":"marker","type":"file","path":"/etc/built","content":"yes","mode":"0644"}]}' ` +
`> /root/built/module.json`); `> ${repo}/module.json`);
await must("anchor", `cd /root/built && git init -q . && git add -A && ` + await must("anchor", `cd ${repo} && git init -q . && git add -A && ` +
`git -c user.email=lab -c user.name=lab commit -qm built`); `git -c user.email=lab -c user.name=lab commit -qm built`);
try { try {
await mesh("build /root/built --wait 300s", 420_000); await mesh(`build ${repo} --wait 300s`, 420_000);
} catch (why) { } catch (why) {
// The builder's own account of itself. Without it the failure is "nothing consumed the // The builder's own account of itself. Without it the failure is "nothing consumed the
// queue", which names no cause and is the same sentence whether the credential was refused, // queue", which names no cause and is the same sentence whether the credential was refused,