| 1 | # The root instance-control service (isolated-exec design §5). Socket- |
| 2 | # activated, so it runs only while there is work. Its whole job is |
| 3 | # systemctl start/stop/set-property on the three instance templates' units |
| 4 | # and their host slices, on the agent's request, plus running the readiness |
| 5 | # probe. Every unit name it passes to systemctl is built from a validated |
| 6 | # host by the platform's own naming; nothing from a request reaches |
| 7 | # systemctl as a string. |
| 8 | # |
| 9 | # Runs as ROOT deliberately, with no new-privileges lockout and no syscall |
| 10 | # filter, for the systemctl child (the same rationale as |
| 11 | # carlos-stage.service). It accepts a connection only from the edge unit's |
| 12 | # main process (SO_PEERCRED uid carlos, pid == MainPID of |
| 13 | # carlos-edge.service): a flat tenant is a child of that pid, never the pid |
| 14 | # itself, and a nested tenant cannot reach the socket at all. |
| 15 | # |
| 16 | # At start it also looks UNDER the two instance bind mounts (unshare -m in |
| 17 | # a private namespace, umount, list; design §8.2, "Recovery for a layout |
| 18 | # that was unmounted anyway"). Files left in the raw mountpoint directory |
| 19 | # while the layout was unmounted would otherwise be hidden by the mount and |
| 20 | # invisible to the layout pass's destination check; a held file is a |
| 21 | # failing line in every probe report and keeps /ready refusing nested wakes |
| 22 | # until an operator moves or removes it and restarts this service. Root is |
| 23 | # what makes that inspection possible: the private namespace and the umount |
| 24 | # need CAP_SYS_ADMIN. ProtectSystem=strict leaves /data and /run visible. |
| 25 | [Unit] |
| 26 | Description=carlos instance control (root: start/stop carlos-instance*@ units for the agent) |
| 27 | Requires=carlos-instance-control.socket data-instances.mount run-carlos-instances.mount run-carlos-logs.mount |
| 28 | After=data-instances.mount run-carlos-instances.mount run-carlos-logs.mount |
| 29 | |
| 30 | [Service] |
| 31 | ExecStart=/opt/carlos/carlos instance-control |
| 32 | ProtectSystem=strict |
| 33 | # /run/systemd/system: the per-generation runtime drop-in (zero-downtime |
| 34 | # deploys, plan 2 D1); nothing else is written there. |
| 35 | ReadWritePaths=/run/carlos-control /run/systemd/system |
| 36 | ProtectHome=yes |
| 37 | PrivateTmp=yes |
| 38 | PrivateDevices=yes |
| 39 | ProtectKernelTunables=yes |
| 40 | ProtectKernelModules=yes |
| 41 | ProtectKernelLogs=yes |
| 42 | RestrictAddressFamilies=AF_UNIX |
| 43 | MemoryDenyWriteExecute=yes |
| 44 | MemoryMax=64M |
| 45 | |
amadan