From 6b83ca0713146efba9690f3e0278d5c2444bee08 Mon Sep 17 00:00:00 2001 From: svenvg93 Date: Mon, 5 Oct 2026 08:32:23 +0200 Subject: [PATCH] fix(agent): make package update checks work as the sandboxed agent user The agent runs as the beszel user under ProtectSystem=strict, so package managers that write temp, cache or log files failed with only "exit status 1" in the log. - Include the command's stderr in check errors. - dnf5 (Fedora 41+): point XDG_STATE_HOME and XDG_CACHE_HOME into the agent's data dir. They default to $HOME, which is /nonexistent for the beszel user. With -C, dnf5 still reads the system metadata cache. - zypper: keep the solv cache in the data dir with --solv-cache-dir, since the agent user cannot rebuild it in /var/cache/zypp. - pacman: read the system sync databases with pacman -Qu instead of syncing a private copy with checkupdates. This drops the pacman-contrib and fakeroot dependencies and pacman's download sandbox, which fails in containers without Landlock. Like the other managers, it never refreshes the databases itself. - install-agent.sh, Debian unit: add PrivateTmp=yes. The script adds it to existing units too when re-run. dnf4 (Rocky, Alma) and zypper keep temporary files in /var/tmp, which ProtectSystem=strict makes read-only. dnf4 hardcodes /var/tmp, so the agent cannot work around it. apt does not need it; the Debian unit gets it so both units stay the same. --- agent/test-data/package_updates/pacman_checkupdates.txt | 4 ---- 1 file changed, 4 deletions(-) delete mode 100644 agent/test-data/package_updates/pacman_checkupdates.txt diff --git a/agent/test-data/package_updates/pacman_checkupdates.txt b/agent/test-data/package_updates/pacman_checkupdates.txt deleted file mode 100644 index 8a3ccd922..000000000 --- a/agent/test-data/package_updates/pacman_checkupdates.txt +++ /dev/null @@ -1,4 +0,0 @@ -libpcap 1.10.7-1 -> 1.11.0-1 -libsecret 0.21.7-1 -> 0.21.8.2-1 -libtirpc 1.3.7-1 -> 1.3.8-1 -tzdata 2026c-1 -> 2026d-1