crabbox-nesting-dns
| Version | 2026.247.0100 |
| Repo | box/cachyos |
Bakes a working resolver AND a private UTS namespace into the nested rootless podman via a containers.conf drop-in (containers.conf.d/99-crabbox-dns.conf with [containers] dns_servers=[“9.9.9.9”] and utsns=“private” — the container-nesting recipe’s utsns=host makes podman refuse crabbox’s lease hostname: “cannot set hostname when running in the host UTS namespace”, RCA round 9; userns=host stays — the mount_too_revealing fix is untouched). The box’s built-in gateway resolver is HOST-dependent (rootless aardvark-dns DNAT varies by host), so crabbox local-container leases and the container-nesting smoke resolve registries from a fixed resolver instead — host-independent beds. The observable effect: podman reads the drop-in and the nested containers’ resolv.conf names 9.9.9.9.
Services
Section titled “Services”cbx-storage-prewarm
Acceptance plan
Section titled “Acceptance plan”This candy’s plan: — the runnable spec charly check executes against a live deployment. check: steps are idempotent probes; run: steps change state.
| Intent | Step |
|---|---|
run |
generate the crabbox user config with the no-hostname opt-in (upstream |
run |
restore user ownership of the box user’s cache root (a build-time root step created /home/user/.cache as root:root 755 — crabbox’s local-container bootstrap then fails with permission denied) |
run |
create the containers.conf drop-in directory for the box user |
run |
write the nested-podman DNS drop-in (user location) |
run |
write the nested-podman drop-in (system location, for root-posture consumers) |
run |
ensure the box user’s crabbox cache root exists and is user-owned (the build runs as root, so the dirs land root-owned and the lease bootstrap then EPERMs — RCA 2026.247.1416) |
run |
prepare the host-backed storage root for the box user |
run |
override the user storage graphroot to the host-backed volume — the recipe’s ~/.local/share sits on the box’s fuse rootfs, so nested fuse-overlayfs dir-create EPERMs (RCA matrix 2026-09-04; a volume-backed upper is single-fuse and supports mkdir) |
run |
restore /tmp to world-writable sticky — a build-time step left it 755 root and supervisord’s /tmp/supervisord.log then EACCES at uid-1000 (RCA 2026.247.1406) |
run |
create the system drop-in dir |
check |
the nested-podman DNS drop-in is present in the image |