Struct RunnerPool 

pub struct RunnerPool {
    pub gid: u32,
    pub accounts: Vec<RunnerAccount>,
    pub legacy: Option<RunnerAccount>,
}

The accounts a Linux boot service’s runners run as, one per concurrent runner, all in RUNNER_GROUP.

Fields

gid: u32

RUNNER_GROUP’s id.

accounts: Vec<RunnerAccount>

The accounts a new attempt may be given, in order of preference.

legacy: Option<RunnerAccount>

The single account an earlier release ran every runner as: accepted for an attempt it already owns, and given to a new one only when the pool has no account of its own yet.

Implementations

impl RunnerPool

pub fn for_this_daemon() -> Result<Option<Self>, String>

The pool runners launched by this process run as: Ok(None) when they run as this process does.

Some only for root on Linux with the pool present, which is what service install --start-at boot sets up. A login service, a foreground daemon and every other platform keep their runners in their own account, as before.

A boot unit’s daemon is root with a narrowed capability bounding set that still holds CAP_DAC_OVERRIDE and the rest of crate::service::BOOT_CAPABILITIES. A runner it started as itself would keep them, so without the pool it must start none. A root with every capability – sudo runner-manager daemon run in a terminal – keeps its runners as itself, as before.

Errors

Why no runner may start: the pool is missing under a confined root.

pub fn lookup() -> Option<Self>

The pool as it exists on this host, or None when it has no account at all.

pub fn ensure() -> Result<Self, String>

The pool, with RUNNER_GROUP and every account up to POOL_SIZE created as system accounts where missing.

Errors

What groupadd or useradd reported, when one had to run and failed.

pub fn account(&self, uid: u32) -> Option<RunnerAccount>

The pool account, or the legacy one, with user id uid.

pub fn allocate( &self, owner: Option<RunnerAccount>, held: &BTreeSet<u32>, busy: impl FnOnce() -> BTreeSet<u32>, ) -> Option<RunnerAccount>

The account an attempt runs as. owner is the one that already owns its directory, kept unless another live attempt holds it (held): a persistent slot kept since an earlier attempt then moves to a free account. Otherwise the first account neither held nor busy (which is asked only then) is chosen. While the pool has no account of its own, every attempt shares the legacy one. None when all are taken.

pub fn share_tree(&self, path: &Path) -> Result<()>

Shares path and everything under it with every account in the pool: the group becomes RUNNER_GROUP, which may read and write it, new entries in a directory inherit that group (set-group-ID), and a default ACL gives the group write access to what any account creates later, whatever umask that account’s job runs with.

A directory already shared is not entered, so a second call over a large cache costs one lstat. Links are never followed.

Errors

The first error met, after which the rest of the tree is not visited.

pub fn is_shared(&self, metadata: &Metadata) -> bool

Whether metadata describes a directory Self::share_tree has already shared.

Trait Implementations

impl Clone for RunnerPool

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RunnerPool

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for RunnerPool

impl PartialEq for RunnerPool

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for RunnerPool