Skip to content

codex/fix podman e2e host fixtures #3607

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
drew wants to merge 1 commit into from
+12 −6
Closed

codex/fix podman e2e host fixtures #3607

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions architecture/sandbox.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,9 @@ The Podman runtime descriptor pins the supervisor's host-network gateway for
reserved host aliases: loopback on native Podman, or the configured Podman
Machine gateway. Policy DNS uses that driver-provided value instead of trusting
container `/etc/hosts` contents.
The host-networked Podman supervisor cannot use DNS aliases scoped to a
separate Podman fixture network; host-backed fixtures use published ports and
the pinned host alias.
The sandbox probes HTTP/2 connection liveness every five seconds and closes
connections that miss a ten-second acknowledgement deadline. Closing a
connection freezes the owned workload process tree and cancels its stream
Expand Down
3 changes: 3 additions & 0 deletions crates/openshell-driver-podman/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,9 @@ The runtime descriptor pins the host gateway used by policy DNS: native
Podman uses the supervisor's host-network loopback, while Podman Machine uses
the configured host gateway address. The reserved host alias is authorized
against that pin rather than an untrusted `/etc/hosts` entry.
Tests that run support containers publish their ports on the host and address
them through this alias, since network-scoped Podman DNS aliases are unavailable
to the host-networked supervisor.

The channel contains the sandbox bootstrap and sandbox-side TLS identity only.
Supervisor private keys and the runtime descriptor stay in the supervisor's private filesystem.
Expand Down
12 changes: 6 additions & 6 deletions e2e/rust/src/harness/container.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,12 +161,12 @@ impl ContainerHttpServer {
let engine = ContainerEngine::from_env()?;
let host_port = find_free_port();
let network = e2e_network_name();
// A host-networked Docker supervisor cannot use a Docker network's DNS
// aliases, but it can route directly to containers on the bridge. Use
// the fixture's bridge address instead of overloading the reserved
// host alias, which may point at the CI job container. Podman keeps the
// shared-network alias path.
let use_host_port = network.is_none();
// The Podman supervisor uses host networking and cannot resolve DNS
// aliases registered only on a fixture's Podman network. Publish the
// fixture on the host instead, using the driver's pinned host alias.
// A host-networked Docker supervisor can route directly to containers
// on its bridge; keep that path when a Docker network is available.
let use_host_port = network.is_none() || is_e2e_driver("podman");
let mut host = if use_host_port {
"host.openshell.internal".to_string()
} else {
Expand Down
Loading