feat(runner): derive the agent uid from the Runner's euid on the host backend (RIG-3512) - #1125
Merged
trunk-io[bot] merged 2 commits intoSep 13, 2026
Conversation
rigel-mintaka
added this pull request to stack #1126
September 12, 2026 00:25
|
Compass engineering docs preview: https://compass-service-owner-rig-35-fszb.compass-eng-docs.pages.dev Deployed from |
This was referenced Sep 12, 2026
Merged
mattwilkinsonn
approved these changes
Sep 12, 2026
… backend (RIG-3512) The baked agent uid names the uid the agent image bakes /nix and $HOME as. The host backend runs no image, so on a Runner whose euid is not 1000 -- the normal case, and the premise of the tier -- every provision exec passed AsUser(1000) and the backend refused it. The uid now comes from the Runner's own effective uid whenever the resolved engine is the host backend, read from the engine itself rather than by re-deriving the backend name, so the flag-then-env fallback stays in the one place that applies it. Every container tier keeps the baked constant, which their userns remap maps the invoking uid onto. Geteuid returns -1 where the syscall is missing, so a negative value is refused instead of wrapping to a huge uid. Root still falls to the existing non-root check, which refuses it at startup rather than at the first provision. Co-authored-by: Matt Wilkinson <matt@rigel.build>
…ity (RIG-3512) The derivation read the effective uid a second time, independently of the one the host backend captured at construction and enforces in checkUser. The two agreed only because the euid does not change during startup, so the contract closure was incidental rather than structural. The host backend now names its own workspace uid from that captured value, and the runner resolves it through a capability probe beside the non-root check that validates the result. A backend without the capability keeps the baked fleet constant, which is correct for the container tiers rather than an oversight, so this probe defaults where the preflight probe fails closed. This also moves per-backend policy out of the runner binary, which its own package doc says assembles flags and env and leaves seam logic to the runner package. Co-authored-by: Matt Wilkinson <matt@rigel.build>
rigel-mintaka
force-pushed
the
compass-service-owner/rig-3512-host-uid
branch
from
September 12, 2026 19:37
baac2a4 to
3d66da3
Compare
mattwilkinsonn
approved these changes
Sep 12, 2026
|
This pull request was merged into |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR is part of a stack containing 10 PRs:
mainThe baked agent uid names the uid the agent image bakes /nix and $HOME
as. The host backend runs no image, so on a Runner whose euid is not
1000 -- the normal case, and the premise of the tier -- every provision
exec passed AsUser(1000) and the backend refused it.
The uid now comes from the Runner's own effective uid whenever the
resolved engine is the host backend, read from the engine itself rather
than by re-deriving the backend name, so the flag-then-env fallback
stays in the one place that applies it. Every container tier keeps the
baked constant, which their userns remap maps the invoking uid onto.
Geteuid returns -1 where the syscall is missing, so a negative value is
refused instead of wrapping to a huge uid. Root still falls to the
existing non-root check, which refuses it at startup rather than at the
first provision.
Co-authored-by: Matt Wilkinson matt@rigel.build