Ward

Ward is a disposable Arch Linux environment for pi and its shared tmux server. It runs as a rootless Podman container under the user systemd instance. It exists to give a coding agent an exact, reproducible toolchain that can be rebuilt and discarded at any time, without touching host state.

The image pins an Arch snapshot and installs the full package set in one transaction. The container runs rootless with dropped capabilities and private namespaces; its writable root is discarded on stop, and only declared bind mounts — projects, selected configuration, and agent state — persist. The tmux server runs in the container and exposes its socket, so sessions are driven by host clients. Networking is shared with the host; Ward isolates state, not the network.

Host setup

sudo pacman --needed -S github-cli openssh podman tmux
systemctl --user enable --now ssh-agent.socket podman.socket

The ward unit syncs the ward-github-token podman secret from gh auth token at every start and exposes it in the container as GH_TOKEN. The start fails when gh is not authenticated on the host.

Deploy

From the repository root:

install -d -m 0700 "$HOME/.config/containers/systemd"
ln -sT "$PWD" "$HOME/.config/containers/systemd/ward"
systemctl --user daemon-reload
systemctl --user start ward.service

Apply

systemctl --user daemon-reload
systemctl --user --job-mode=ignore-requirements \
    restart ward-build.service &&
systemctl --user restart ward.service

The container is restarted only after a successful build.

Start a session

tmux -S "$XDG_RUNTIME_DIR/ward/tmux.sock"

Remove

systemctl --user stop ward.service ward-build.service
rm -- "$HOME/.config/containers/systemd/ward"
systemctl --user daemon-reload
podman image rm localhost/ward:latest
podman secret rm ward-github-token