fortiblox/arc-mev-bot
Watch
3
0
Fork
You've already forked arc-mev-bot
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(deploy): StateDirectory= instead of ReadWritePaths= (226/NAMESPACE on first install) #21

Merged
buddysan merged 1 commit from fix/devops-p5-statedirectory-namespace-bug into main 2026-09-16 16:37:45 +00:00
Conversation 2 Commits 1 Files changed 3 +27 -6
buddysan commented 2026-09-16 16:12:07 +00:00
Owner
Copy link

Summary

  • ProtectSystem=strict + ReadWritePaths=/var/lib/arc-mev-bot requires the path to pre-exist; systemd builds the mount namespace before ExecStartPre runs, so a fresh host (LXC 140) failed with 226/NAMESPACE on both units and never started.
  • Switched to StateDirectory=arc-mev-bot, systemds purpose-built idiom for this. Hardening (ProtectSystem=strict/ProtectHome=read-only/PrivateTmp/NoNewPrivileges) unchanged.
  • Reproduced + fix verified live on LXC 140 2026-09-16 with systemd-run isolating the exact failing property combo, then re-tested with StateDirectory added.

WP 7916.

Co-Authored-By: Claude Sonnet 5 [email protected]

## Summary - `ProtectSystem=strict` + `ReadWritePaths=/var/lib/arc-mev-bot` requires the path to pre-exist; systemd builds the mount namespace before ExecStartPre runs, so a fresh host (LXC 140) failed with `226/NAMESPACE` on both units and never started. - Switched to `StateDirectory=arc-mev-bot`, systemds purpose-built idiom for this. Hardening (ProtectSystem=strict/ProtectHome=read-only/PrivateTmp/NoNewPrivileges) unchanged. - Reproduced + fix verified live on LXC 140 2026-09-16 with `systemd-run` isolating the exact failing property combo, then re-tested with StateDirectory added. WP 7916. Co-Authored-By: Claude Sonnet 5 <[email protected]>
fix(deploy): StateDirectory= instead of ReadWritePaths= to fix 226/NAMESPACE on first install
All checks were successful
ci / forge-tests (pull_request) Successful in 54s
Details
ci / python-tests (pull_request) Successful in 3m6s
Details
ci / forge-tests (push) Successful in 3m4s
Details
ci / python-tests (push) Successful in 3m57s
Details
bd308e25c4
 
ProtectSystem=strict + ReadWritePaths=/var/lib/arc-mev-bot required that path to already
exist on disk, since systemd builds the unit's mount namespace before any process of the
unit runs -- including ExecStartPre, which was supposed to create it. On a fresh host this
made ExecStartPre itself fail with 226/NAMESPACE, blocking both units from ever starting.

Reproduced live on LXC 140 (2026-09-16, WP 7916 install) with a bare systemd-run using the
same two properties against a non-existent path. StateDirectory=arc-mev-bot is systemd's
purpose-built fix: it creates /var/lib/arc-mev-bot and grants write access before namespace
setup. No change to the hardening posture (ProtectSystem=strict/ProtectHome=read-only/
PrivateTmp/NoNewPrivileges all unchanged).

WP 7916.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Signed-off-by: BuddySan <[email protected]>
fortiblox-dev approved these changes 2026-09-16 16:37:44 +00:00
fortiblox-dev left a comment
Copy link

automerger v2 auto-approved: all 7 gates pass. Approver: fortiblox-dev (opposite-identity rule). Gates: mergeable=true,label=auto-merge,author=buddysan,identity=ok,status_checks=not_required,signatures=upstream_BP_only,opt_in=repo_marker.

automerger v2 auto-approved: all 7 gates pass. Approver: fortiblox-dev (opposite-identity rule). Gates: mergeable=true,label=auto-merge,author=buddysan,identity=ok,status_checks=not_required,signatures=upstream_BP_only,opt_in=repo_marker.
buddysan deleted branch fix/devops-p5-statedirectory-namespace-bug 2026-09-16 16:37:45 +00:00
buddysan commented 2026-09-16 16:37:45 +00:00
Author
Owner
Copy link

Auto-merged by forgejo-automerger at 2026-09-16 16:37:45 UTC. Approver: fortiblox-dev (opposite-identity rule, Option C upgrade 2026-05-13). Merger: buddysan via fast-forward-only (NOT admin force_merge). Criteria passed: mergeable=true,label=auto-merge,author=buddysan,identity=ok,status_checks=not_required,signatures=upstream_BP_only,opt_in=repo_marker. Branch bd308e25c4 merged onto main and feature branch deleted. See project_forgejo_automerger memory for rationale.

Auto-merged by **forgejo-automerger** at 2026-09-16 16:37:45 UTC. **Approver:** `fortiblox-dev` (opposite-identity rule, Option C upgrade 2026-05-13). **Merger:** `buddysan` via `fast-forward-only` (NOT admin `force_merge`). **Criteria passed:** `mergeable=true,label=auto-merge,author=buddysan,identity=ok,status_checks=not_required,signatures=upstream_BP_only,opt_in=repo_marker`. Branch `bd308e25c4` merged onto `main` and feature branch deleted. See `project_forgejo_automerger` memory for rationale.
Sign in to join this conversation.
Reviewers
No reviewers
fortiblox-dev
Labels
Clear labels   
auto-merge
Opt-in: automerger will land this PR after CI green + all gates pass

  
auto-merge
Automerge when CI passes (set by webhook bridge)

No labels
auto-merge
auto-merge
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
fortiblox/arc-mev-bot!21
No description provided.