docs(storage): populate the shared store once, by hand #71

Merged

tepichord merged 1 commit from docs/nix-store-seed into main

2026-09-18 22:54:46 -07:00

tepichord commented

2026-09-18 22:23:14 -07:00

Owner

§10g's populate container warmed nothing and could not have. It asked for
nixpkgs#terraform …, which outside the flake resolves from the unstable
channel rather than flake.lock, so even a run that finished would have
installed paths no step loads; and it did not finish, because terraform's
bsl11 license is unfree and the flake's own allowUnfreePredicate is what
lets that evaluate. Collapse it to the half that mattered — a seed job that
copies the image's store into the claim, proves the path /bin/sh points at
exists inside it, and uses cp -an, so a re-run is a no-op on a seeded store
and a repair on a partial one where the old guard saw the directory and
skipped, leaving the hole.

A step whose pod mounts an empty store cannot exec its entrypoint at all,
because /bin/sh is a symlink into the store that the mount hides — which is
why the pipeline reported nothing for an hour instead of failing. The comment
in gates.yaml said it failed as nix: not found; it now says what it does.
OPERATIONS.md carries the bring-up step and the hand-run row.

Story 19 states what the volume is for, and the two checks that hold it up
name it: the class aliases every claim to one directory whatever namespace or
name it carries, so the CI step is one consumer of the store and not its
owner.

Refs #51.

§10g's populate container warmed nothing and could not have. It asked for `nixpkgs#terraform …`, which outside the flake resolves from the unstable channel rather than flake.lock, so even a run that finished would have installed paths no step loads; and it did not finish, because terraform's `bsl11` license is unfree and the flake's own allowUnfreePredicate is what lets that evaluate. Collapse it to the half that mattered — a seed job that copies the image's store into the claim, proves the path /bin/sh points at exists inside it, and uses `cp -an`, so a re-run is a no-op on a seeded store and a repair on a partial one where the old guard saw the directory and skipped, leaving the hole. A step whose pod mounts an empty store cannot exec its entrypoint at all, because /bin/sh is a symlink into the store that the mount hides — which is why the pipeline reported nothing for an hour instead of failing. The comment in gates.yaml said it failed as `nix: not found`; it now says what it does. OPERATIONS.md carries the bring-up step and the hand-run row. Story 19 states what the volume is for, and the two checks that hold it up name it: the class aliases every claim to one directory whatever namespace or name it carries, so the CI step is one consumer of the store and not its owner. Refs #51.

tepichord added 1 commit

2026-09-18 22:23:14 -07:00

docs(storage): populate the shared store once, by hand

ci/woodpecker/pr/gates Pipeline was successful

Details

ci/woodpecker/pull_request_closed/cleanup Pipeline was successful

Details

2344234cd7

§10g's populate container warmed nothing and could not have. It asked for
`nixpkgs#terraform …`, which outside the flake resolves from the unstable
channel rather than flake.lock, so even a run that finished would have
installed paths no step loads; and it did not finish, because terraform's
`bsl11` license is unfree and the flake's own allowUnfreePredicate is what
lets that evaluate. Collapse it to the half that mattered — a seed job that
copies the image's store into the claim, proves the path /bin/sh points at
exists inside it, and uses `cp -an`, so a re-run is a no-op on a seeded store
and a repair on a partial one where the old guard saw the directory and
skipped, leaving the hole.

A step whose pod mounts an empty store cannot exec its entrypoint at all,
because /bin/sh is a symlink into the store that the mount hides — which is
why the pipeline reported nothing for an hour instead of failing. The comment
in gates.yaml said it failed as `nix: not found`; it now says what it does.
OPERATIONS.md carries the bring-up step and the hand-run row.

Story 19 states what the volume is for, and the two checks that hold it up
name it: the class aliases every claim to one directory whatever namespace or
name it carries, so the CI step is one consumer of the store and not its
owner.

Refs #51.