spindle

Self-hosted Tangled spindle

Fork 0

S0: Build the spindle mill image from Tangled v1.20.0 (ENG-463) #2

Merged

demi.dev 1w ago

targeting main from stoopkidddd/eng-463-s0-build-the-spindle-mill-image-from-tangled-v1200

Merged opened by and assigned to

demi.dev 1w ago targeting main from stoopkidddd/eng-463-s0-build-the-spindle-mill-image-from-tangled-v1200

Linear: ENG-463

Summary #

A container image that runs the spindle in the mill role. Railway runs it in ENG-465.

mill/Dockerfile: a multi-stage linux/amd64 build.
- The build stage is nixos/nix:2.35.4, the same tag as the checks. It builds git+https://tangled.org/tangled.org/core?ref=refs/tags/v1.20.0#pkgsStatic-spindle. The static build succeeded, so the closure fallback wasn't needed.
- The runtime stage is digest-pinned debian:forky-slim, with git (2.53.0) and ca-certificates.
- It runs as UID/GID 10001, exposes 6555, and puts state under /data.
mill/entrypoint.sh:
- writes SPINDLE_SIGNING_KEY_PEM to /run/spindle/key.pem (mode 600) and unsets the variable;
- sets SPINDLE_SERVER_KEY_PATH, then runs exec spindle;
- exits 1 with a clear message if the variable is missing.
mise.toml: adds the mill:build and mill:smoke tasks.
scripts/mill-smoke.sh: generates a throwaway P-256 key in a temp dir, runs the image as a dev mill with a disk artifact store, checks health, the exact DID key, key file mode and SIGTERM, then cleans up.

Verify (lead, on the branch rebased onto `main`) #

$ mise run check            → check_exit=0 (includes the executor flake)
$ mise run mill:build       → build_exit=0 (cold build 43 min under Rosetta; image 264 MiB)
$ mise run mill:smoke
GET /_health: 200
GET /.well-known/did.json: did:web:localhost, matching P-256 public key
Signing key permissions: 600
SIGTERM: clean exit (0)
Private-key markers in container output: 0
mill: smoke passed

BEGIN EC PRIVATE KEY appears 0 times in the captured build and smoke logs. No smoke containers or volumes are left behind.

Deviations #

Runtime base is Debian testing (forky-slim), digest-pinned. Tangled requires git ≥ 2.49, and trixie ships 2.47.3.
filter-syscalls = false in the Nix build stage only. Rosetta rejects Nix's seccomp filter. The runtime image is unaffected.
The smoke test uses SPINDLE_CONTACT_EMAIL=smoke@example.invalid, because the mill role requires a contact email.
Round 2 removed an out-of-scope README section. Its facts moved to ENG-465.

🤖 Generated with Claude Code

Commits 3

S0: Fix mill ownership on root-owned volumes (ENG-463)

+13 -3

S0: Remove out-of-scope mill README section (ENG-463)

-17

S0: Build the mill image from Tangled v1.20.0 (ENG-463)

+199

Comments

v0 1w ago

demi.dev 1w ago

Review round 1 (pneumo-reviewer): REQUEST_CHANGES #

Reviewed at e7bc029 (v0).

The image builds as a static pkgsStatic-spindle binary (ldd reports "not a dynamic executable"; /nix/store is empty) with Git 2.53. The entrypoint and smoke test do what the issue asks. hadolint, shellcheck, mise run check and mill:smoke all pass, with 0 key markers.

The blocker is the image's only target: a Railway volume mounted at /data is owned by root.

Findings #

FIX (often 8 × bad 4 = 32) mill/Dockerfile:35,47, scripts/mill-smoke.sh:27: the image runs as USER 10001:10001, and all state lives in /data. On Railway the volume at /data is owned by root, so lockInstance fails to open /data/spindle.db.lock with EACCES and the mill crash-loops.
- Reproduced locally with --mount type=volume,target=/data,volume-nocopy=true, which gives "Permission denied".
- The smoke test passes only because a new named volume copies the image's /data, which the spindle user owns.
- Fix:
  - start the entrypoint as root;
  - chown spindle:spindle /data (the mount root only);
  - write the key with mode 600, owned by spindle;
  - exec setpriv --reuid=spindle --regid=spindle --init-groups -- spindle;
  - in the smoke test, mount the volume with volume-nocopy=true and assert PID 1 runs as uid 10001.
FILE (1 × 4 = 4) mill/Dockerfile:9: Tangled is pinned by tag only, while the executor locks the commit 2096d06d. If the tag moves, a rebuild silently runs a different commit. Filed as ENG-476.
FILE (1 × 3 = 3) mill/Dockerfile:11-22: the automatic fallback from the static to the dynamic build has never been exercised. A transient fetch error could silently ship a different artifact. Filed as ENG-477.
FILE (2 × 2 = 4) mill/entrypoint.sh:16: spindle runs as PID 1 with no init, so zombie git processes can accumulate. Filed as ENG-478.

Spec and DoD checks #

The build stage uses nixos/nix:2.35.4 (the same as NIX_IMAGE). filter-syscalls = false is set in the build stage only.
The runtime is debian:forky-slim: Tangled needs Git ≥ 2.49, and trixie and trixie-backports only offer 2.47.3. The image has git and ca-certificates, a non-root user, and EXPOSE 6555.
The entrypoint:
- writes the key with printf, so it never appears in argv, then sets umask 077 and mode 600;
- unsets the variable before exec;
- exits 1 when the variable is missing or empty.
The smoke test checks:
- health 200;
- a DID document whose multibase key is recomputed from the generated key;
- the key file's mode;
- SIGTERM exit 0;
- cleanup of the temp dir, container and volume.
Scope: only mill/Dockerfile, mill/entrypoint.sh, mise.toml (mill:*) and scripts/mill-smoke.sh change.
DoD:
- hadolint and shellcheck are clean;
- mise run check exits 0, with the executor's toplevel evaluating to cw7cjgqz…;
- docker build succeeds (264 MiB; cold build 43 min);
- BEGIN EC PRIVATE KEY count: 0.

v1 1w ago

demi.dev 1w ago

Review round 2 (pneumo-reviewer): APPROVE #

Reviewed at 53a612d (v1).

Round-1 FIX resolved.

USER is removed.
The entrypoint runs chown spindle:spindle /data on the mount root only.
It writes the key with mode 600 and chowns it to spindle.
It unsets the PEM variable, then runs exec setpriv --reuid=spindle --regid=spindle --init-groups -- spindle.

What was verified:

The image's entrypoint is byte-identical to the worktree file, and the image config has no User.
A volume-nocopy mount starts as root root 755, so the smoke test now reproduces Railway's mount.
The spindle process has uid, gid and groups 10001, and its CapPrm, CapEff and CapAmb are all 0. PID 1 is spindle itself.
SIGTERM still exits 0.

FILE findings 2–4 from v0 stay filed as ENG-476, ENG-477 and ENG-478.

New findings (FILE) #

FILE (3 × 1 = 3) mill/entrypoint.sh:20: setpriv keeps HOME=/root (mode 0700), so git warns /root/.config/git/…: Permission denied. Git still exits 0, but these warnings end up in the mill's error messages for git failures. Filed as ENG-479.
FILE (1 × 2 = 2) mill/entrypoint.sh:14-16: root's write, chmod and chown of the key follow a symlink in a directory that uid 10001 can write to. Exploiting this needs code already running as 10001, and a restart that keeps the writable layer. Filed as ENG-480.

Spec and DoD checks #

hadolint and shellcheck are clean.
mise run check exits 0 (drv cw7cjgqz…).
The cached build exits 0, and the image is 264 MiB.
The smoke test passes, with 0 private-key markers and nothing left behind.
The non-root requirement holds: spindle runs as uid 10001 with no capabilities. Root only runs the short entrypoint.
Scope: v1 touches only mill/Dockerfile, mill/entrypoint.sh and scripts/mill-smoke.sh.

Summary #

Verify (lead, on the branch rebased onto main) #

Deviations #

Versions

Review round 1 (pneumo-reviewer): REQUEST_CHANGES #

Findings #

Spec and DoD checks #

Review round 2 (pneumo-reviewer): APPROVE #

New findings (FILE) #

Spec and DoD checks #

Verify (lead, on the branch rebased onto `main`) #