Module forge_state 

The one host directory tree a QED forge step’s bind mounts may live under.

Why this is a named root rather than a list of paths

runc refuses a bind whose source is missing, and the OCI mapper never mkdirs one — so something has to create each host dir before deploy. yubaba does, but only for paths it recognizes, and “recognizes” was originally a hardcoded match on the produced dir. Every new forge mount then re-learned the lesson the expensive way, on a real box, minutes into a build: R603-B6 for produced/, then R636-B1 for build-out/, each surfacing as the same opaque failed to fulfil mount request: … no such file or directory from deep inside containerd.

Naming the root makes the rule checkable instead of enumerable: yubaba creates any forge bind under [HOST_ROOT], and yubaba.service grants the root once via StateDirectory=yah/qed. A third mount needs no new code and no unit-file edit — it only has to live here.

The prefix bound is load-bearing in the other direction too: it is what keeps a workload spec from asking yubaba to mkdir an arbitrary host path.

Constants

BUILD_OUT_DIR

Host directory a build-image step’s OCI archive is written to, bound at /yah/build/out in the BuildKit container. Shared (rather than per-forge like produced/) because the archive is named after the image tag, which is already unique per build.

HOST_ROOT

Root of the forge’s host-persistent state. Both super::forge_produced::HOST_ROOT and BUILD_OUT_DIR are under it.

Functions

is_forge_state_path

Whether yubaba may create host_path on behalf of a forge workload.