54 lines
1.6 KiB
Fish
Executable File
54 lines
1.6 KiB
Fish
Executable File
#!/usr/bin/env fish
|
|
|
|
# Select a nono profile from a trusted canonical-project map, then launch Pi in
|
|
# its own bounded cgroup. Unknown or invalid projects fail closed.
|
|
set -l resolver /home/jb/.local/bin/orca-nono-profile
|
|
|
|
if not test -x "$resolver"
|
|
printf 'pi-orca: profile resolver is unavailable: %s\n' "$resolver" >&2
|
|
exit 1
|
|
end
|
|
|
|
set -l profile ("$resolver" resolve "$PWD" 2>/dev/null)
|
|
if test $status -ne 0; or test -z "$profile"
|
|
printf 'pi-orca: could not resolve a trusted profile for %s\n' "$PWD" >&2
|
|
exit 1
|
|
end
|
|
|
|
if not /usr/bin/nono profile show "$profile" >/dev/null 2>&1
|
|
printf 'pi-orca: resolved profile is unavailable: %s\n' "$profile" >&2
|
|
exit 1
|
|
end
|
|
|
|
source /srv/data/code/harness-tools/scripts/pi-orca-runtime.fish
|
|
configure_pi_orca_runtime "$profile"
|
|
|
|
set -l node_executable "$pi_orca_node_executable"
|
|
set -l pi_agent_dir "$PI_CODING_AGENT_DIR"
|
|
|
|
if not test -x "$node_executable"
|
|
printf 'pi-orca: Node runtime is unavailable: %s\n' "$node_executable" >&2
|
|
exit 1
|
|
end
|
|
if not test -d "$pi_agent_dir"
|
|
printf 'pi-orca: Pi agent directory is unavailable: %s\n' "$pi_agent_dir" >&2
|
|
exit 1
|
|
end
|
|
|
|
set -lx ORCA_NONO_PROFILE "$profile"
|
|
set -lx PI_CODING_AGENT_DIR "$pi_agent_dir"
|
|
|
|
exec /usr/bin/systemd-run \
|
|
--user \
|
|
--scope \
|
|
--collect \
|
|
--quiet \
|
|
--slice=orca-agents.slice \
|
|
--property=CPUQuota=1600% \
|
|
--property=MemoryHigh=48G \
|
|
--property=MemoryMax=64G \
|
|
--property=MemorySwapMax=8G \
|
|
--property=TasksMax=8192 \
|
|
--property=OOMPolicy=stop \
|
|
-- /usr/bin/nono run --profile "$profile" -- "$node_executable" /home/jb/.bun/bin/pi $argv
|