Process running on the Hyper.Node responsible for creating and managing POSIX users.
The reason we need this is that Firecracker prefers that each new virtual machine we create is managed with a unique user. Each said user needs access to /dev/kvm.
To solve this problem, Hyper.Node.Users mints user ids under the configured group.
Summary
Functions
Free id automatically when owner dies.
Returns a specification to start this module under a supervisor.
Return an id to the pool.
Verify the configured uid/gid range is free, raising if anything occupies it.
Run the given callable with a new UID, freeing it afterward.
Types
@type id() :: integer()
A uid/gid.
Functions
Free id automatically when owner dies.
Returns a specification to start this module under a supervisor.
See Supervisor.
@spec claim() :: {:ok, id()} | {:error, :exhausted}
Allocate an id without auto-freeing. Pair with release/1 or bind/2.
@spec release(id()) :: :ok
Return an id to the pool.
@spec test_system() :: :ok | {:error, term()}
Verify the configured uid/gid range is free, raising if anything occupies it.
Run at node startup so we fail closed: handing out a uid that collides with an
existing user would let a VM run as that user - a security hazard. Checks NSS
users and groups (via getent) and the subordinate-id ranges in /etc/subuid
and /etc/subgid for overlap with the configured range.
@spec with_id((id() -> result)) :: result | {:error, :exhausted} when result: var
Run the given callable with a new UID, freeing it afterward.