Skip to content

_placement

_placement

Where this host runs a container's supervisor — and so, where its readers live.

One fact decides it, and the OCI hook reads the same fact through the same predicate: a per-user systemd manager that answers. With one, the supervisor is a transient user unit in the operator's own namespaces, and the kernel user keyring it reads is the operator's. Without one, it is a daemon inside the container runtime's user namespace, where that keyring is an empty stranger and only a path can carry the passphrase across. The cache tier follows the placement for exactly that reason (see session_cache).

__all__ = ['SupervisorPlacement', 'supervisor_placement'] module-attribute

SupervisorPlacement

Bases: StrEnum

The two homes of a per-container supervisor.

USER_UNIT = 'user unit' class-attribute instance-attribute

A transient unit of the per-user systemd manager.

NAMESPACE_DAEMON = 'namespace daemon' class-attribute instance-attribute

A detached daemon inside the container runtime's user namespace.

supervisor_placement()

Where a supervisor started from this process would run.

Source code in src/terok_sandbox/_util/_placement.py 
34
35
36
37
38
39
def supervisor_placement() -> SupervisorPlacement:
    """Where a supervisor started from this process would run."""
    runtime = _supervisor_state.user_runtime_dir(os.getuid())
    if _supervisor_state.user_manager_reachable(runtime):
        return SupervisorPlacement.USER_UNIT
    return SupervisorPlacement.NAMESPACE_DAEMON