agent: support systemd device group specifiers

[Copilot]

AdditionalHostDevices only accepted /dev/... paths, preventing use of systemd DeviceAllow= groups such as char-input and char-pts.

• Configuration

  • Accept validated char-* and block-* device-group specifiers.
  • Preserve path validation for bind-mounted /dev/... entries.

• nspawn rendering

  • Render device groups as DeviceAllow=... rwm.
  • Exclude device groups from nspawn Bind= directives.

• Coverage

  • Add validation, grouping, and template-rendering tests.

{
  "AdditionalHostDevices": [
    "char-input",
    "char-pts",
    "/dev/uinput"
  ]
}

This renders group access through:

DeviceAllow=char-input rwm
DeviceAllow=char-pts rwm

[Copilot]

Pull request overview

This PR extends the agent’s AdditionalHostDevices handling to support systemd DeviceAllow= device-group specifiers (e.g. char-input, char-pts, block-*) in addition to bind-mounted /dev/... paths, and updates nspawn rendering, validation, and documentation accordingly.

Changes:

• Add parsing/validation for char-* / block-* device-group specifiers alongside /dev/... validation.
• Split host device rendering so group specifiers become DeviceAllow=... rwm only (no Bind=).
• Add tests for validation, grouping, and template rendering; update docs to describe the new behavior.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pkg/agent/phases/rootfs/nspawn.go	Plumbs device-group specifiers into nspawn template data for rendering.
pkg/agent/phases/rootfs/nspawn_render_test.go	Adds template-rendering coverage for device-group specifiers.
pkg/agent/phases/rootfs/assets/service-override.conf	Renders DeviceAllow= lines for both device paths and device-group specifiers.
pkg/agent/goalstates/resolve_test.go	Updates goalstate resolution test to include a device-group specifier.
pkg/agent/goalstates/hostdevices.go	Splits additional host devices into bind-mountable paths vs DeviceAllow group specifiers.
pkg/agent/goalstates/hostdevices_test.go	Adds unit test verifying specifier extraction and path filtering.
pkg/agent/config/config.go	Extends AdditionalHostDevices validation and adds helper for recognizing group specifiers.
pkg/agent/config/config_test.go	Adds tests for group-specifier detection and validation behavior.
docs/content/reference/agent/nspawn.md	Documents the new AdditionalHostDevices behavior and rendering differences.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.