best-peer 0.0.31

best-peer 0.0.31

Each job runs on a disk of its own with a hard size, made and removed by best-peer-disk, a small socket-activated root helper, so the peer itself never needs root or the right to mount.

Commits since v0.0.30

• Review: release opens out with openat and the device check, as the walk opens every directory below it, since the helper's unit answers openat2 ENOSYS (b53e1ac)
• Review: a disk the peer mounts itself, and a job's inputs and outputs, fail in words that name nothing of the host (4ce8521)
• Review: what the disk helper says of the host goes to the peer's log, and an order is told a fixed sentence, so no host path reaches the renter (2289e2f)
• Review: the disks' directory and each disk's root are closed to every user but root and the peer, so no one else on the host reads a job's inputs or plants its outputs (cd85779)
• Review: the loop device behind a peer's own mount is found by the mounted path's device number, so a data folder reached through a link still gets its disks (e3f8bcf)
• Review: a disk's loop device passes no discard on, so a host's fstrim never gives the room reserved for it back (7d87066)
• Review: a disk's image is formatted without discard so its room stays reserved, and list refuses a field it does not take (32d6c8e)
• Review: the disk's total_bytes is described as the largest disk one job may be given here, in the schema, the metric's help and the README (1446ed7)
• Review: a member tells the largest disk it makes as its disk's size, and a cloud places a disk only on a member that makes one that large (9dfef8f)
• Review: each disk is counted once, by the helper's own rule, and the bound on one disk holds each order at ingest, never the room for all (37b748a)
• Review: a disk promised and not yet made counts against the helper's most disks, so the second of two orders admitted at once waits rather than fails at make (6ac6a12)
• Review: the helper lists its bounds and the peer holds its room to them, a failed release is tested, serve is tested over a socket pair, and no client is named (1512be7)
• A release carries best-peer-disk and its two units in the Linux archive, so a node pins the helper with the peer (79700bb)
• BEST_PEER_DISK_HELPER names the disk helper's socket, and the helper ships with its two units and the README's install, so a hardened peer runs jobs with disks (af7d0f2)
• The Docker runtime makes, releases and removes a job's disk through the disk helper when it is given one, so a peer that may not mount still gives each job a disk of its own (775022e)
• A job's disk is laid out by the runtime that makes it and released to the peer before its outputs are packed, so a peer that does not own what the job wrote still reads it (da2ec59)
• A best-peer-disk helper makes, releases and removes a job's disk for a peer that may not mount, since a peer hardened as a service can never mount one dockerd sees (2291ed3)

Run it

One binary, and on Linux the disk helper best-peer-disk with its two systemd units beside it, for a peer run as a user of its own (the README's "Run as a service with the disk helper"). Download the archive for the machine, check it against SHA256SUMS, unpack it and run best-peer with the environment the README's Run section names; best-peer --version says best-peer 0.0.31. Each archive is here twice, byte for byte the same: under the name with the version, for pinning, and under the name without it, which releases/latest/download/<name> resolves to the newest release, as the README's commands use.

Machine	Archive	Same file, unversioned
Linux x86_64 (glibc 2.35 or newer)	best-peer-0.0.31-x86_64-unknown-linux-gnu.tar.gz	best-peer-x86_64-unknown-linux-gnu.tar.gz
Windows x86_64	best-peer-0.0.31-x86_64-pc-windows-msvc.zip	best-peer-x86_64-pc-windows-msvc.zip
macOS Apple silicon	best-peer-0.0.31-aarch64-apple-darwin.tar.gz	best-peer-aarch64-apple-darwin.tar.gz

Every archive carries a build provenance attestation: gh attestation verify <archive> --repo behavioralstate/best-peer.