heavy-duty/box
7
0
Fork 1
Code Issues 9 Pull requests Projects Releases 4 Packages Wiki Activity Actions

docs+drill: grok's export nits — --force documented, backups key drilled live

Browse source 
Three of the four round-1 nits, taken: --force's overwrite role on
export now sits in OPTIONS and 'help export' (it was only in the die
text); the restricted-tier rehearsal asserts restricted.backups=allow
beside the snapshots check it mirrors, so the grant key #70 depends on
is proven live, not only grepped; and reset_identity says "instance" —
it has two callers now, and only one of them clones. The install.sh
message stays #79's (the documented merge order).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
dan-claude-bot 2026-07-18 18:13:01 +00:00
parent 1ef3ae739a
commit 2bbc53d1dd
2 changed files with 10 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
bin/box
View file

@ -161,7 +161,7 @@ OPTIONS
dev/test only. Default where /dev/kvm is absent. dev/test only. Default where /dev/kvm is absent.
--json Emit Incus JSON instead of a table (list, info) --json Emit Incus JSON instead of a table (list, info)
--instance-only Export the live state only, no snapshots (export) --instance-only Export the live state only, no snapshots (export)
--force, -f Delete without the confirmation prompt (rm) --force, -f Delete without asking (rm); overwrite the file (export)
--remote <r> Act on Incus remote <r> (any) --remote <r> Act on Incus remote <r> (any)
--help, -h Help; after a command, help for that command --help, -h Help; after a command, help for that command
--version, -V Print the box version --version, -V Print the box version
@ -347,6 +347,7 @@ the reuse workflow (log in once, snapshot, clone forever) lives in them.
box export <box> [<file>] # default file: <box>-<UTC timestamp>.tar.gz box export <box> [<file>] # default file: <box>-<UTC timestamp>.tar.gz
--instance-only # live state only, leave the snapshots behind --instance-only # live state only, leave the snapshots behind
--force # overwrite an existing <file> (refused otherwise)
The box must be stopped first ('box down <box>'). Incus can back up a running The box must be stopped first ('box down <box>'). Incus can back up a running
instance, but a live root disk is a moving target — and this artifact's whole instance, but a live root disk is a moving target — and this artifact's whole
@ -804,7 +805,7 @@ wait_agent() {
# the reset costs one reboot. Do it before handing the box over, never after. # the reset costs one reboot. Do it before handing the box over, never after.
reset_identity() { reset_identity() {
local i="$1" local i="$1"
echo "box: giving the clone its own identity (machine-id, DHCP lease)..." echo "box: giving the instance its own identity (machine-id, DHCP lease)..."
# Do NOT truncate machine-id and reboot: systemd needs a valid one to shut # Do NOT truncate machine-id and reboot: systemd needs a valid one to shut
# down cleanly, so the graceful stop hangs and the reboot never happens — # down cleanly, so the graceful stop hangs and the reboot never happens —
# leaving the clone on its source's identity, which is the bug we are here to # leaving the clone on its source's identity, which is the bug we are here to

7
drill/multiuser.sh
View file

@ -151,6 +151,13 @@ snaps="$(incus project get "$p1" restricted.snapshots 2>/dev/null)"
[ "$snaps" = allow ] && ok "snapshots allowed in $p1 (the clone workflow exists)" \ [ "$snaps" = allow ] && ok "snapshots allowed in $p1 (the clone workflow exists)" \
|| no "restricted.snapshots = '$snaps' — box snapshot will refuse" || no "restricted.snapshots = '$snaps' — box snapshot will refuse"
# The same shape for backups (#70): export rides the backup API, which
# restricted projects block by default exactly like snapshots. A grant that
# missed this key strands every post-upgrade 'box export' at the tier.
bkups="$(incus project get "$p1" restricted.backups 2>/dev/null)"
[ "$bkups" = allow ] && ok "backups allowed in $p1 (box export works at this tier)" \
|| no "restricted.backups = '$bkups' — box export will refuse"
incus --project "$p1" profile device get default eth0 type >/dev/null 2>&1 \ incus --project "$p1" profile device get default eth0 type >/dev/null 2>&1 \
&& no "(h) $p1's default profile still carries the private-bridge eth0" \ && no "(h) $p1's default profile still carries the private-bridge eth0" \
|| ok "(h) $p1's default profile places no network — box-net is the only door" || ok "(h) $p1's default profile places no network — box-net is the only door"