Repository navigation
Conversation
…ce they cannot hold Podman's Docker-compatible API drops the network options the fence relies on (the interface name, masquerade off, inter-container traffic off), so on a Podman worker every fenced deploy failed the network check, and a fresh install defaults to fenced. The worker now detects Podman from /version and resolves to a new unsupported mode: earners deploy on Podman's default network, the fleet page and the isolation check say they are not fenced, and turning isolation on is refused with the reason. With CASHPILOT_ISOLATION=on a deploy is refused before the running container is touched, since the fence was asked for.
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 19 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #635 +/- ##
=======================================
Coverage 93.97% 93.98%
=======================================
Files 74 74
Lines 15678 15699 +21
=======================================
+ Hits 14733 14754 +21
Misses 945 945
🚀 New features to boost your workflow:
|
Owner
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
On a Podman worker the LAN fence cannot work, and the worker did not know that. Podman's Docker-compatible API drops the network options the fence relies on: the interface name (
com.docker.network.bridge.name), masquerade off and inter-container traffic off. netavark then adds its own masquerade. So the network check failed on every fenced deploy. A fresh install defaults to fenced, which meant no bridge earner could be deployed on Podman at all.Fix
The worker reads
/version, and when the engine names itself Podman it resolves to a newunsupportedmode, as the Desktop app already does:CASHPILOT_ISOLATION=on, a deploy is refused before the running container is touched, because the fence was asked for and cannot be given.CASHPILOT_ISOLATION=offandCASHPILOT_CONTAINER_NETWORKstill take precedence. The.isolation_onmarker is not written in this mode./versionis taken for Docker, so the fence's own checks still apply.docs/isolation.mdanddocs/isolation-check.mdnow say Podman is detected and not fenced, where before they said "not tested".Tests
TestPodmanintests/test_lan_fence.pycovers detection from a real Podman 5/versionshape, mode resolution, the deploy path (default network, no helper), the refusal underon, the periodic check, the refused switch and the isolation-check wording. Against main, 12 of the 13 fail. The one that passes is the case where an engine that does not answer is taken for Docker, and main does that anyway.Desktop needs nothing: it already has this behaviour (
isPodmanandFenceModeUnsupportedininternal/runtime/lanfence.go). This PR brings the web worker in line with it.Not checked against a live Podman engine. Detection relies on Podman's documented
/versioncomponent name, "Podman Engine".