docs(nix): explain guest secret access

2026-10-20 04:39:34 -04:00
parent b25e7106d6
commit 38e1a8630d
1 changed files with 2 additions and 2 deletions
--- a/src/skills/style/nix/rules/dotfiles.md
+++ b/src/skills/style/nix/rules/dotfiles.md
@@ -39,5 +39,5 @@ Each guest service group accesses its secrets through a read-only bind mount.

 ### Rationale

-SOPS materializes secrets on the host filesystem.
-Read-only bind mounts prevent guest services from modifying the host copy.
+Guest service accounts do not exist on the host, where SOPS creates secrets.
+The shared service group preserves read access across the guest boundary.