fix(test): assert guest egress over TCP, not ICMP, for VM-boot CI#13
Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughThis PR resolves a Docker networking issue where the host's FORWARD chain policy inadvertently blocks VM internet egress. Changes include iptables rules in CI, a test update from ping to TCP egress verification, and documentation of the limitation and workaround across README and ADR. ChangesDocker FORWARD Fix and Egress Verification
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
README.md (1)
309-315: ⚡ Quick winClarify the destination rule command.
Line 315's phrasing "add the matching
-d 192.168.0.0/16rule" doesn't show the complete command. Consider making it explicit:yourself: `sudo iptables -I DOCKER-USER -s 192.168.0.0/16 -j ACCEPT` and `sudo iptables -I DOCKER-USER -d 192.168.0.0/16 -j ACCEPT` for the return path.The workflow file at lines 59-60 shows both rules in full; matching that clarity here would help operators.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@README.md` around lines 309 - 315, Update the README paragraph so the return-path rule is shown as a complete iptables command instead of just mentioning "-d 192.168.0.0/16"; replace the trailing sentence to explicitly show both commands: "sudo iptables -I DOCKER-USER -s 192.168.0.0/16 -j ACCEPT" and "sudo iptables -I DOCKER-USER -d 192.168.0.0/16 -j ACCEPT" (mirroring the full rules used in the workflow).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/adr/0025-linux-netlink-nftables.md`:
- Around line 129-131: The sentence calling it "the one-line `DOCKER-USER`
allow" is inaccurate because the README documents a two-rule workaround (an `-s`
rule for egress and a corresponding `-d` return-path rule); update the phrasing
to reflect that (for example, "the two-rule `DOCKER-USER` workaround" or "the
`DOCKER-USER` allow rules") so the ADR matches the README guidance.
---
Nitpick comments:
In `@README.md`:
- Around line 309-315: Update the README paragraph so the return-path rule is
shown as a complete iptables command instead of just mentioning "-d
192.168.0.0/16"; replace the trailing sentence to explicitly show both commands:
"sudo iptables -I DOCKER-USER -s 192.168.0.0/16 -j ACCEPT" and "sudo iptables -I
DOCKER-USER -d 192.168.0.0/16 -j ACCEPT" (mirroring the full rules used in the
workflow).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 637a2910-2672-409a-9060-b981a07798fb
📒 Files selected for processing (4)
.github/workflows/vm-linux.ymlREADME.mddocs/adr/0025-linux-netlink-nftables.mdfleetboxtest/conformance_vm_test.go
pilat
force-pushed
the
fix/linux-egress-and-brew-trust-docs
branch
from
93cdf99 to
df50641
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two things, both surfaced right after v0.4.0 shipped.
The bigger one: the VM-boot CI on
mainwent red. With the v0.4.0 unification it now boots the full suite and, for the first time, asserts that a guest can reach the public internet — which failed immediately. Chasing it took a couple of wrong turns, but the cause is the test environment, not the backend. GitHub-hosted runners drop outbound ICMP entirely (the runner host itself can't ping 1.1.1.1, while TCP works), so the conformance test'sping-based egress check was a false negative. On top of that the runners run Docker, which sets the iptables FORWARD policy to DROP — the same conflict that breaks libvirt and LXD on Docker hosts — so forwarded guest traffic is dropped before it's masqueraded. The fix asserts egress with a TCP connect to 1.1.1.1:443 instead of ping (a better egress proof anyway) and opens the VM subnet through DOCKER-USER on the runner so the forward survives Docker's policy. fleetbox itself still does not touch the host firewall — that is a deliberate ADR-0025 decision — so the Docker-host egress ceiling is now spelled out as a limitation for real users, with the one-line DOCKER-USER allow they can add if they want egress on such a host.The smaller one: Homebrew 6.0 made third-party tap trust mandatory, so installing the cask now needs a one-time
brew trustfirst. The install docs carry that step.Checklist
ARCHITECTURE.mdupdated in this PRdocs/adr/(next sequential number)!in the title) → the description spells out what callers must changeSummary by CodeRabbit
Documentation
Bug Fixes