mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 02:54:26 +00:00
kevinveenbirkenbachandClaude Opus 5
c83b0b46fe
YAML treats # inside a block scalar as text, so the directive became part of the command. ansible.builtin.command starts no shell and splits on whitespace, which turned '#', 'nocheck:' and 'container-exec-resolver' into container names the daemon then reported as missing. The real inspect succeeded; the non-zero exit came only from those three. Put the directive behind the scalar indicator, where YAML reads it as a comment, matching how the rest of the repository writes it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
20 lines
1017 B
YAML
20 lines
1017 B
YAML
---
|
|
# Param: assert_isolated_container - name of the container that must not run under the shared kernel
|
|
- name: "🔍 Read the runtime '{{ assert_isolated_container }}' actually got"
|
|
ansible.builtin.command: >- # nocheck: container-exec-resolver runtime probe, the container name comes from the caller
|
|
container inspect --type container {{ assert_isolated_container }}
|
|
--format {{ '{{.HostConfig.Runtime}}' }}
|
|
register: assert_isolated_runtime
|
|
changed_when: false
|
|
|
|
- name: "🛑 Refuse an agent running under the shared kernel"
|
|
ansible.builtin.assert:
|
|
that:
|
|
- (assert_isolated_runtime.stdout | trim) != 'runc'
|
|
fail_msg: >-
|
|
'{{ assert_isolated_container }}' runs under
|
|
'{{ assert_isolated_runtime.stdout | trim }}', which is the host kernel.
|
|
This container executes code the model wrote, so the deploy is refused
|
|
rather than left looking healthy. Check that svc-virt-kata installed the
|
|
isolating runtime on this host and that the daemon restarted onto it.
|