Configuration

The files lnk cloud and lnk box keep, and what each one holds. A box spec's every field and default: box spec. lnk help <command> lists the environment variables each command reads, as plugin.toml declares them.

On this computer

What lnk cloud and lnk box keep in Link's settings folder.

~/.lnk/cloud/accounts.toml

Mode 600: the connected accounts, and what each cloud's CLI needs to act as them.

~/.lnk/aws/ and ~/.lnk/gcp/

Mode 700: the AWS CLI and gcloud, when lnk cloud connect installed them, for you only and with no administrator rights.

~/.lnk/gcp/credentials/<name>.json

Mode 600: a Google Cloud account's credential file, a service account's key or your login's application default credentials. Result-upload signing passes the connected service-account file's path explicitly to gcloud; no private key value is passed as an argument.

~/.lnk/box/

Mode 700: the boxes, Link's SSH key for them (id_ed25519), this computer's SSH certificate authority (ssh-ca.pub, its secret in ssh-ca off a Mac) and the certificates it signed (certs/), their host keys (known_hosts), and lock files.

~/.lnk/box/boxes.toml

Mode 600: this computer's boxes, each with the spec it was made from (lnk box spec).

~/.lnk/box/mux/

Mode 700: the sockets of the SSH connections to boxes kept open for a minute after a lnk box run.

On a box

What lnk box create writes on a box, and what its users and workers need there.

~/.lnk/machine.toml

Its machine ID and name, written by lnk box create (machine_script), keeping an ID the box already has.

/etc/lnk/kind.toml

Mode 644, root's: that it's a box, and its OS and processor (kind = "box", os, arch), written as root at its first boot by lnk box create. Without it, a machine is a computer; written by anyone but root, it's refused (What's on a Box).

/etc/lnk/users/<name>/

Mode 755, root's: a user of the box (lnk box user add): user.toml (their folder and key), <name>.toml (their sandbox's spec, its paths absolute) and authorized_keys (their key's one line, a forced command into their sandbox), each 644 (What's on a Box).

/usr/local/lib/lnk/

Mode 755, root's: root's copies of lnk and lnk-sandbox, which a box user's sessions run, refreshed by each lnk box user add. Ordinary workers also enter through lnk-sandbox; refresh that helper with lnk sandbox workers --install after sandbox upgrades.

/etc/ssh/sshd_config.d/60-lnk-users.conf

Mode 644, root's: for the group lnk-users, their keys read from /etc/lnk/users/<name>/authorized_keys, never their own home's, and no forwarding.

A Linux box's workers

What lnk sandbox workers --install puts on a Linux box for its workers (worker security).

/etc/lnk/workers.json

Mode 644, root's: the worker launch mode. ordinary records the controller's uid, gid and groups; packed selects the image's existing slot identities. lnk sandbox workers --install installs ordinary mode. A box without this trusted configuration refuses work.

/var/lib/lnk/workers/

Mode 700, root's: worker account journals and the durable monotonic next-id counter. Preserve the counter across upgrades; missing or invalid state refuses new work.

/run/lnk-workers/<name>/

Mode 700, root's: a worker's temporary private mount views, detached during cleanup without removing the underlying state.

/etc/sudoers.d/lnk-worker-descriptors

Mode 440, root's: command-scoped descriptor and PATH handling for the installed helper; it grants no sudo authorization.

/etc/systemd/system/lnk-workers-reap.service

Mode 600, root's: boot cleanup of interrupted worker journals, installed by lnk sandbox workers --install.

In the cloud

What Link names and tags in the cloud account, and what it keeps there rather than on your computer.

A box's machine

Each box's machine is named lnk-<machine id> and tagged (labelled on Google Cloud) lnk-box=<name>, lnk-machine=<machine id> and lnk-owner=<your account's owner ID>. A spec's own tags are added to those, at most 40; on AWS its disk has them too, and a spot box's request.

Its host keys

The host keys pinned at its first boot are kept on it: metadata lnk-host-keys on Google Cloud, a lnk-host-key tag on AWS.

An image

An image lnk box image create makes is named lnk-<name> in the box's account and tagged (labelled) lnk-image=<name> and lnk-owner=<your account's owner ID>, and lnk-hash=<hash> when saved with --hash; on AWS its snapshot has them too. Nothing about images is kept on your computer.