fix(gateway): handle delayed Podman bridge listeners - #2874
Conversation
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
|
Label |
|
/ok-to-test e2e39b4 |
elezar
changed the title
|
🌿 Preview your docs: https://nvidia-preview-pr-2874.docs.buildwithfern.com/openshell |
|
/ok-to-test fa02b7d |
8be2ce6 to
1ca8c32
Compare
|
/ok-to-test 1ca8c32 |
fe4097d to
d31a034
Compare
|
/ok-to-test 5c8c586 |
| --copy "${candidate_cli_package[0]}:/var/lib/openshell-conformance/candidate/openshell.rpm" \ | ||
| --copy "${candidate_gateway_package[0]}:/var/lib/openshell-conformance/candidate/openshell-gateway.rpm" \ | ||
| --install "${candidate_cli_package[0]}" \ | ||
| --install "${candidate_gateway_package[0]}" \ |
There was a problem hiding this comment.
@SDAChess just a note. This removes the "upgrade" test. There were some rough edges to sort out. For example, with the "upgrade" flow as defined, we were testing the latest stable release for the initial test cases and then only upgrading.
The latest release also didn't work as expected with "rootful podman" (which is also why the Fedora canary is failing).
5c8c586 to
f5cde26
Compare
Signed-off-by: Evan Lezar <elezar@nvidia.com>
Signed-off-by: Evan Lezar <elezar@nvidia.com>
35374e3 to
5f2ac04
Compare
f5cde26 to
3bccf31
Compare
1 participant
Summary
Fix rootful Podman gateway startup when Podman has allocated a managed bridge gateway address but netavark has not assigned that address yet. The gateway uses delayed exact binding where Linux supports it and a narrowly scoped fallback for the nested Fedora canary topology.
This PR is stacked on #3184, which adds the reusable rootful Podman test-guest configuration.
Related Issue
No issue required: this is a focused fix for a reliably failing Fedora release-canary regression. Longer-term driver-owned callback relay work remains tracked in #2540.
Release Canary reference: https://github.com/NVIDIA/OpenShell/actions/runs/32448768823/job/96673135310
Changes
IP_FREEBINDwhen the bridge gateway address has not yet been assigned.Security impact
The nested-container fallback exposes only the sandbox-callable gRPC surface on non-loopback IPv4 destinations in the outer container namespace. User, administrator, health, reflection, non-callback inference, and HTTP routes remain unavailable there. Sandbox authentication and the surrounding container-network boundary remain required defenses.
Testing
mise run pre-commitcargo check -p openshell-server -p openshell-driver-podmangit diff --check origin/main..HEADChecklist