tmk241/apsuflow-skills
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(skill): document portable isolation profiles

Browse Source
This commit is contained in:
tmk241
2026-08-09 18:22:35 +02:00
parent 3fd81620fc
commit 22634be910
1 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/apsuflow/SKILL.md
+7 -6
View File
@@ -43,12 +43,13 @@ in the same change when applicable requirements or CLI behavior change.
- Cluster servers replicate control-plane state; agents execute workloads but do - Cluster servers replicate control-plane state; agents execute workloads but do
not add quorum votes. not add quorum votes.
- The unprivileged service daemon owns OCI children inside its delegated cgroup - The unprivileged service daemon owns OCI children inside its delegated cgroup
v2 subtree. A supervisor may prepare root-owned host networking/firewall state, v2 subtree. A supervisor may prepare root-owned cgroup and firewall state, but
but the long-running daemon must not gain root merely to bypass a failed the long-running daemon must not gain root merely to bypass a failed profile.
profile. Stable host support is defined by Linux capabilities rather than a The signed artifact is proved on systemd and runit profiles; support is defined
distribution, libc, or init brand; advertise a concrete profile only after its by equivalent Linux capabilities rather than a distribution, libc, or init
complete isolation and golden path pass. Routine CLI use remains unprivileged brand. `doctor` must name the effective supervisor and writable delegated
and authenticated. boundary, and apply must fail closed when that boundary is missing. Routine CLI
use remains unprivileged and authenticated.
- `.apsu` contains desired workloads and infrastructure, never secret values or - `.apsu` contains desired workloads and infrastructure, never secret values or
mutable runtime state. mutable runtime state.
- Services are continuously reconciled. Jobs are finite run-to-completion work. - Services are continuously reconciled. Jobs are finite run-to-completion work.