kyle/imladris
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

straylight: grant mcp-agent KVM + tun access for unikernels

Browse Source 
Override the shared mcp.nix sandbox (PrivateDevices) on straylight so the
MCP agent can boot Nanos unikernel VMs under QEMU/KVM and manage TAP
devices for isolated networking.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Kyle Isom
2026-06-11 00:47:17 -07:00
parent f2a76df239
commit 5ffe206f72
1 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
hw/straylight/default.nix
View File

@@ -1,4 +1,4 @@
{ inputs, pkgs, ... }: { inputs, pkgs, lib, ... }:
{ {
imports = [ imports = [
./hardware-configuration.nix ./hardware-configuration.nix
@@ -9,6 +9,19 @@
]; ];
config = { config = {
# straylight is the unikernel host. The shared mcp.nix locks the agent
# down with PrivateDevices=true, which hides /dev/kvm and /dev/net/tun.
# Relax that here (only on straylight) so the agent can boot Nanos
# unikernel VMs under QEMU/KVM and (Phase 2) manage TAP devices.
systemd.services.mcp-agent.serviceConfig = {
PrivateDevices = lib.mkForce false;
DeviceAllow = [ "/dev/kvm rw" "/dev/net/tun rw" ];
SupplementaryGroups = [ "kvm" ];
AmbientCapabilities = [ "CAP_NET_ADMIN" ];
};
# Let the mcp user reach /dev/kvm directly as well.
users.users.mcp.extraGroups = [ "kvm" ];
# Allow rootless containers (podman) to bind low ports (53 for MCNS, # Allow rootless containers (podman) to bind low ports (53 for MCNS,
# 443/8443/9443 for mc-proxy) as straylight takes over the core role. # 443/8443/9443 for mc-proxy) as straylight takes over the core role.
boot.kernel.sysctl."net.ipv4.ip_unprivileged_port_start" = 53; boot.kernel.sysctl."net.ipv4.ip_unprivileged_port_start" = 53;