From b186f31e9bfa228f2a4739636e105c39725f3314 Mon Sep 17 00:00:00 2001 From: tmk241 Date: Sun, 9 Aug 2026 15:49:02 +0200 Subject: [PATCH] docs(skill): require portable rootless host profiles --- skills/apsuflow/SKILL.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/skills/apsuflow/SKILL.md b/skills/apsuflow/SKILL.md index 3824339..4e2b4ff 100644 --- a/skills/apsuflow/SKILL.md +++ b/skills/apsuflow/SKILL.md @@ -42,8 +42,12 @@ in the same change when applicable requirements or CLI behavior change. - Solo mode is one loopback-bound server without cluster mesh overhead. - Cluster servers replicate control-plane state; agents execute workloads but do not add quorum votes. -- The privileged daemon owns OCI, cgroups, CNI, WireGuard, nftables, and host-path - effects. Routine CLI use should be unprivileged and authenticated. +- The unprivileged service daemon owns OCI children inside its delegated cgroup + v2 subtree. A supervisor may prepare root-owned host networking/firewall state, + but the long-running daemon must not gain root merely to bypass a failed + profile. Stable host profiles target Debian glibc/systemd and Void Linux + musl/runit; advertise one only after its complete isolation and golden path + pass. Routine CLI use remains unprivileged and authenticated. - `.apsu` contains desired workloads and infrastructure, never secret values or mutable runtime state. - Services are continuously reconciled. Jobs are finite run-to-completion work.