Repository navigation
ci(rust): run unit tests network-off in a loopback-only namespace - #1
Closed
John-David Dalton (jdalton) wants to merge 2 commits into
Closed
John-David Dalton (jdalton) wants to merge 2 commits into
John-David Dalton (jdalton) wants to merge 2 commits into
Conversation
The .codex/ dir (codex harness config) is generated from .claude/ (the source of truth) as part of the release/setup shakeout — like .cursor/, .windsurf/, .janus/ — never committed. Ignore it via the fleet-canonical block and untrack the config.toml + hooks.json that leaked into the cascade.
Compiled-language equivalent of the JS/TS nock.disableNetConnect() gate: wrap the cargo test run in a net namespace with only loopback up, so real outbound calls fail while localhost fixtures still work. Deps pre-fetched online; sandbox wraps only the test run. Fail-closed — errors if no namespace can be created, with a curl self-check proving egress is blocked before trusting it. Spike for #68 (network-off tests across fleet langs); validates the mechanism on depot-ubuntu-24.04 before promoting it to a shared wheelhouse action.
Collaborator
Author
|
Superseded — the netns network-off change landed on main directly (fleet cadence, no PRs), rebased clean off current main without the stale |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Spike for #68 — give cargo tests the same network-off guarantee JS/TS has via nock. The test run is wrapped in a net namespace with only loopback up, so real outbound calls fail while localhost fixtures still work; deps are pre-fetched online first, and a curl self-check proves egress is blocked before trusting the sandbox (fail-closed if no namespace can be created).
Validating the
unshare/AppArmor mechanism ondepot-ubuntu-24.04here before promoting it to a shared wheelhouse action + cascading to decmpfs/abitious. envrypt's dep budget already forbids network, so its tests should pass offline — a failure means the sandbox caught a real leak.Note
Medium Risk
CI behavior changes for all Rust tests (sandbox or job failure), but scope is limited to the test job and fail-closed verification reduces risk of silently running tests online.
Overview
Rust CI no longer runs
cargo testwith full network access. The workflow builds arun-offline.shwrapper that usesunshare --netwith loopback only, relaxes Ubuntu 24.04 AppArmor user-namespace restrictions when needed, and fails the job if namespaces are unavailable or if a curl probe toexample.comsucceeds inside the sandbox. Dependencies are fetched online withcargo fetch --lockedfirst; workspace tests andenvryptdoctests then run with--offlineinside that sandbox—mirroring the JS/TS no-live-network test policy (#68).Repo hygiene: tracked
.codex/config.tomland.codex/hooks.jsonare removed from the tree, and/.codex/is added to.gitignoreso Codex MCP/hook projections stay generated locally like other cross-harness adapter dirs.Reviewed by Cursor Bugbot for commit 7c232e9. Configure here.