The agent runs as the beszel user under ProtectSystem=strict, so package
managers that write temp, cache or log files failed with only
"exit status 1" in the log.
- Include the command's stderr in check errors.
- dnf5 (Fedora 41+): point XDG_STATE_HOME and XDG_CACHE_HOME into the
agent's data dir. They default to $HOME, which is /nonexistent for
the beszel user. With -C, dnf5 still reads the system metadata cache.
- zypper: keep the solv cache in the data dir with --solv-cache-dir,
since the agent user cannot rebuild it in /var/cache/zypp.
- pacman: read the system sync databases with pacman -Qu instead of
syncing a private copy with checkupdates. This drops the
pacman-contrib and fakeroot dependencies and pacman's download
sandbox, which fails in containers without Landlock. Like the other
managers, it never refreshes the databases itself.
- install-agent.sh, Debian unit: add PrivateTmp=yes. The script adds it
to existing units too when re-run. dnf4 (Rocky, Alma) and zypper keep
temporary files in /var/tmp, which ProtectSystem=strict makes
read-only. dnf4 hardcodes /var/tmp, so the agent cannot work around
it. apt does not need it; the Debian unit gets it so both units stay
the same.
svenvg93
6b83ca0713