Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 1 addition & 3 deletions docker/Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -32,9 +32,7 @@ RUN --mount=type=cache,target=/nix,from=nixos/nix:latest,source=/nix \
ln -s "$bin" /out/test-nix/bin/$(basename "$bin"); \
done && \
mkdir -p /out/test-rootfs/tmp \
/out/test-rootfs/usr/local/bin \
/out/test-rootfs/var/run \
/out/test-rootfs/var/lib/intermesh && \
/out/test-rootfs/usr/local/bin && \
chmod 1777 /out/test-rootfs/tmp

FROM e2e-builder AS builder
Expand Down
19 changes: 17 additions & 2 deletions src/state/mod.rs
Original file line number Diff line number Diff line change
Expand Up @@ -137,7 +137,20 @@ impl State {
/// If a field isn't provided via args/env, we fall back to the state file.
pub(crate) async fn new(args: Args) -> Result<Self> {
if let Some(parent) = args.state_file.parent() {
fs::create_dir_all(parent).await?;
fs::create_dir_all(parent).await.with_context(|| {

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI-generated review draft. This has not been reviewed by a human. Any comments made are non-binding; feel free to ignore them by resolving. This uses the same AI-review process Ethan uses to review his own code.

Can we add a regression test where state_file lives under a missing nested directory? The existing state tests use tmpdir.path().join("state.toml"), so they would still pass if the startup path stopped creating /var/lib/intermesh; now that the Docker rootfs no longer pre-creates that directory, the runtime creation is the core behavior this PR depends on.

format!("failed to create state directory {}", parent.display())
})?;
#[cfg(unix)]
{
fs::set_permissions(parent, Permissions::from_mode(0o700))
.await
.with_context(|| {
format!(
"failed to set permissions on state directory {}",
parent.display()
)
})?;
}
}

let mut private_key_pem = None;
Expand Down Expand Up @@ -368,7 +381,9 @@ impl State {
.context("state file has no parent directory")?
.to_path_buf();

fs::create_dir_all(&parent_dir).await?;
fs::create_dir_all(&parent_dir).await.with_context(|| {
format!("failed to create state directory {}", parent_dir.display())
})?;

// The tempfile + fsync + rename sequence uses blocking std::fs APIs.
// Run it on Tokio's blocking pool so we don't stall async tasks.
Expand Down