nvx-rs: stop reading the activation record's template and workload identity

nvx-rs/README.md

@@ -1429,12 +1429,10 @@ For a GPT disk, it first asks the kernel to reread the disk's partition table
 with `BLKRRPART`, since the kernel created the block devices of partitions for
 the template's placeholder. Whatever the image, it requires a fresh upper, whose
 `upper` and `work` directories are missing or empty, in a bounded check that
-reads no file, while a cold sandbox's scratch keeps its upper across boots. With
-the record's workload identity, it checks its account in the assembled root
-before Ready, as NVX's init checks it at boot: `entry::Identity::new(uid, gid)`,
-without supplementary groups or capabilities, in existing-account mode, as which
-every execution runs, while without one each execution names its own identity,
-which `Entry::check` checks. With the record's generated machine ID, it then
+reads no file, while a cold sandbox's scratch keeps its upper across boots. It
+ignores the record's workload identity, if it has one: each execution names its
+own identity, which `Entry::check` checks, as in a sandbox without a workload
+identity at a cold boot. With the record's generated machine ID, it then
 generates one, once, with `MachineId::generate`, after the repair's reseed, so
 that no two clones share it, to `MACHINE_ID_FILE` in the template's runtime
 directory. With the record's export, it mounts the host export through that

nvx-rs/public-api/linux.txt

@@ -675,7 +675,6 @@ struct nvx::guest::clone::Applied (hidden)
 method nvx::guest::clone::Applied::announcer (hidden)
 method nvx::guest::clone::Applied::announcer_mut (hidden)
 method nvx::guest::clone::Applied::hostname (hidden)
-method nvx::guest::clone::Applied::identity (hidden)
 method nvx::guest::clone::Applied::into_parts (hidden)
 method nvx::guest::clone::Applied::machine_id (hidden)
 method nvx::guest::clone::Applied::proxy (hidden)
@@ -688,9 +687,6 @@ struct nvx::guest::clone::AppliedTeardownError (hidden)
 method nvx::guest::clone::AppliedTeardownError::binds (hidden)
 method nvx::guest::clone::AppliedTeardownError::root (hidden)
 enum nvx::guest::clone::ApplyError (hidden)
-variant nvx::guest::clone::ApplyError::Account (hidden)
-field nvx::guest::clone::ApplyError::Account::error (hidden)
-field nvx::guest::clone::ApplyError::Account::teardown (hidden)
 variant nvx::guest::clone::ApplyError::Assembly (hidden)
 field nvx::guest::clone::ApplyError::Assembly::0 (hidden)
 variant nvx::guest::clone::ApplyError::Export (hidden)

nvx-rs/src/activation/mod.rs

@@ -44,10 +44,8 @@
 //!   proxy, if any, which holds no credentials;
 //! - the [`WorkloadView`]: the hostname, the [`MachineIdMode`], the image's own machine ID or one
 //!   that the guest generates, and the [`WorkloadIdentity`], if any: a UID and a GID, neither 0
-//!   nor `u32::MAX`, whose account the image must hold, without supplementary groups or
-//!   capabilities, in which every execution runs, as each execution of a layered sandbox runs
-//!   today. An adapter whose executions name their own identity, as CRI containers do, leaves it
-//!   out;
+//!   nor `u32::MAX`, which the guest ignores as it applies the record, since each execution of a
+//!   clone names its own identity, as CRI containers do;
 //! - the root's settings: the [`OverlayMode`], the [`Journal`] policy of a scratch upper, and the
 //!   bound of a GPT disk's first partition;
 //! - the [`ExpectedResources`]: the CPU count and the memory size that the guest must have, as a
@@ -461,8 +459,8 @@ pub enum MachineIdMode {
     Generated,
 }
 
-/// The identity in which every execution of a workload runs: a UID and a GID, neither 0 nor
-/// `u32::MAX`, whose account the image must hold, without supplementary groups or capabilities.
+/// A workload identity that an activation record may carry: a UID and a GID, neither 0 nor
+/// `u32::MAX`. The guest ignores it as it applies the record: each execution names its own.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
 pub struct WorkloadIdentity {
     /// The user ID: neither 0 nor `u32::MAX`.
@@ -478,7 +476,8 @@ pub struct WorkloadView {
     pub hostname: Vec<u8>,
     /// The machine ID that the workload sees.
     pub machine_id: MachineIdMode,
-    /// The identity in which every execution runs, unless the executions name their own.
+    /// A workload identity, which the guest ignores as it applies the record: each execution
+    /// names its own.
     pub identity: Option<WorkloadIdentity>,
 }
 

nvx-rs/src/guest/clone.rs

@@ -165,12 +165,10 @@
 //! at a cold boot. The upper must be fresh: the assembly refuses one whose `upper` or `work`
 //! directory exists and is not empty, since a clone's root starts as its image alone, while a cold
 //! sandbox's scratch keeps its upper across boots; the check reads at most one entry of each, and
-//! no file. If the record has a workload identity, it then checks its account in the assembled
-//! root, before Ready, as NVX's init checks it at boot: the identity is
-//! [`Identity::new`](super::entry::Identity::new) of the record's user and group IDs, without
-//! supplementary groups or capabilities, in existing-account mode, and every execution runs as it.
-//! Without one, the adapter gives each execution its own identity, which
-//! [`Entry::check`](super::entry::Entry::check) checks. If the record asks for a generated machine
+//! no file. It takes no identity in which the executions run from the record, whose workload
+//! identity, if any, has no effect: the adapter gives each execution the identity that the
+//! execution names, which [`Entry::check`](super::entry::Entry::check) checks, as for a sandbox
+//! without a workload identity at a cold boot. If the record asks for a generated machine
 //! ID, it then generates one, once, with
 //! [`MachineId::generate`](super::entry::MachineId::generate), after the repair's reseed, so that
 //! no two clones of a template share it, to [`MACHINE_ID_FILE`] in the template's runtime