vh
ce7b07f7af
Operator ruling: remove the groups and see what breaks. Nothing did. ana-docker llmuser sudo+docker -> none; irv-ml1 llmuser sudo -> none (it was never in docker there). 45 containers on ana-docker and 18 on irv-ml1 all still running with zero unhealthy, and lora-training-worker stayed active. Extended to irv-ml1 because it is the same account with the same defect and gpasswd -a reverses it in one command; ana-docker was only the host the audit happened to run against first. The durable lesson is why it was safe, and it is a measurement trap rather than a permissions one. reported 19 processes on ana-docker and 3 on irv-ml1, which reads as a busy service account. Nearly all of them were CONTAINER processes whose in-image UID is 1001 and therefore collides with llmuser on the host — /proc/<pid>/cgroup shows docker-*.scope. A container's runtime UID is unrelated to host group membership, so the groups were buying those workloads nothing. The single real host workload sets User=/Group= explicitly through systemd, which does not consult the sudo group either. Recorded in the conventions doc so the next audit checks the cgroup before concluding a host account is busy — otherwise a UID collision blocks a cleanup that carries no risk.
docs/
Navigation map for the documentation tree. New session? Read
orientation.md first — it's the narrative overview
of the fleet, backup architecture, governing principles, and gotchas,
and it points at everything else.
Tree
docs/
├── orientation.md # start here — fleet overview + where-to-look guide
├── runbooks/ # ops runbooks (recovery, deployment phases)
│ ├── disaster-recovery.md
│ ├── nh3-prune-ritual.md
│ └── pbs-deployment.md
└── pfi/ # PFI-specific reference (services, models, VMs)
├── docker-stack.md
├── model-list.md
├── proxmox-vms.md
├── recommended-model-settings.md
├── vm-102-matrix-appservice.md
└── vm-102-matrix-synapse.md
What goes where
runbooks/— step-by-step ops procedures. Anything you'd reach for during an incident or while standing up new infrastructure. Examples: disaster recovery (blast-radius tiers + restoration steps), PBS deployment (9-phase rollout). New runbook → new file here.pfi/— PFI-specific reference material that's too narrow for the top-level CLAUDE.md but doesn't change incident response. AI model inventory, recommended inference settings, Matrix bridge config, Proxmox VM map. New stable reference → new file here.- Top-level (
docs/orientation.md,docs/README.md) — narrative guides about the workspace itself, not about specific infra.
Cross-references
- Fleet topology + servers table: top-level
CLAUDE.md. - Open work + recent milestones: top-level
STATUS.md. - Durable cross-session facts:
~/.claude/projects/-home-lkraven-development-eshpfi-management/memory/.
Conventions
- Markdown, GitHub-flavored. CommonMark renders fine in most viewers.
- File names are lowercase-kebab-case, descriptive. No dates in filenames — git history covers that.
- One topic per file. If a file grows past ~500 lines, look for a natural split before adding more.
- No checked-in binaries or checksums. Build/release artifacts belong
in a build pipeline or
tools/, notdocs/.