tmk241/apsuflow-skills
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(skill): require portable rootless host profiles

Browse Source
This commit is contained in:
tmk241
2026-08-09 15:49:02 +02:00
parent 4959a2f5a3
commit b186f31e9b
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/apsuflow/SKILL.md
+6 -2
View File
@@ -42,8 +42,12 @@ in the same change when applicable requirements or CLI behavior change.
- Solo mode is one loopback-bound server without cluster mesh overhead.
- Cluster servers replicate control-plane state; agents execute workloads but do
not add quorum votes.
- The privileged daemon owns OCI, cgroups, CNI, WireGuard, nftables, and host-path
effects. Routine CLI use should be unprivileged and authenticated.
- The unprivileged service daemon owns OCI children inside its delegated cgroup
v2 subtree. A supervisor may prepare root-owned host networking/firewall state,
but the long-running daemon must not gain root merely to bypass a failed
profile. Stable host profiles target Debian glibc/systemd and Void Linux
musl/runit; advertise one only after its complete isolation and golden path
pass. Routine CLI use remains unprivileged and authenticated.
- `.apsu` contains desired workloads and infrastructure, never secret values or
mutable runtime state.
- Services are continuously reconciled. Jobs are finite run-to-completion work.