T9229: adds documentation for sys-rawio

[opswill]

Change Summary

Related Task(s)

https://vyos.dev/T9229

Related PR(s)

vyos/vyos-1x#5419

Backport

Checklist:

• I have read the CONTRIBUTING document

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 7de6c3c7-bb70-4fe9-80d4-1600e2639634

📥 Commits

Reviewing files that changed from the base of the PR and between 204bf3c and c139696.

📒 Files selected for processing (1)

• docs/configuration/container/index.md

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• ansible/ansible (manual)

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (2)

• GitHub Check: Mergify Merge Protections
• GitHub Check: Summary

⚠️ CI failures not shown inline (4)

GitHub Actions: AI Validation / prepare: T9229: adds documentation for sys-rawio

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m# Fetch the base branch explicitly by refname to avoid ambiguity with�[0m
 �[36;1m# same-named tags (e.g., a `rolling` tag), then diff against FETCH_HEAD.�[0m
 �[36;1mgit fetch --no-tags --depth=1 origin "refs/heads/rolling"�[0m
 �[36;1mBASE="FETCH_HEAD"�[0m
 �[36;1m# --diff-filter=ACMRT excludes Deleted entries so the bundling�[0m
 �[36;1m# loop below (`git show HEAD:<path>`) doesn't try to extract�[0m
 �[36;1m# blobs for files that no longer exist in the merge ref.�[0m
 �[36;1m# Deletions still appear in diff-md.patch (full diff) but not�[0m
 �[36;1m# in changed-md.txt (which drives the bundling step).�[0m
 �[36;1mgit diff "$BASE...HEAD" --name-only --diff-filter=ACMRT -z -- ':(glob)docs/**/*.md'  > changed-md.z�[0m
 �[36;1mgit diff "$BASE...HEAD" --name-only --diff-filter=ACMRT -z -- ':(glob)docs/**/*.rst' > changed-rst.z�[0m
 �[36;1m# Reject paths containing line-disrupting control bytes (LF, CR,�[0m
 �[36;1m# other 0x01-0x1F + 0x7F) before generating the newline-delimited�[0m
 �[36;1m# *.txt manifests. NUL itself can't appear in a git pathname�[0m
 �[36;1m# (it's the on-disk tree-entry terminator), so it stays out of�[0m
 �[36;1m# the rejection class and remains the legitimate record delimiter�[0m
 �[36;1m# for `git diff -z` — `grep -z` honors that contract.�[0m
 �[36;1m#�[0m
 �[36;1m# POSIX filesystems generally allow LF/CR in filenames and git�[0m
 �[36;1m# stores them fine; the hazard is purely in our line-delimited�[0m
 �[36;1m# downstream tooling. Without this guard, `tr '\0' '\n'` on a�[0m
 �[36;1m# path like `docs/foo\nbar.md` would split it into two logical�[0m
 �[36;1m# lines — downstream consumers reading line-by-line would miss�[0m
 �[36;1m# validation coverage on the real file (or worse, act on a�[0m
 �[36;1m# synthetic path). Fail fast at this seam.�[0m
 �[36;1m#�[0m
 �[36;1m# An earlier `tr -d '\0\n\r' | grep [\x00-\x1F\x7F]` form�[0m
 �[36;1m# stripped the very bytes it was m...

---

GitHub Actions: AI Validation / validate: T9229: adds documentation for sys-rawio

Conclusion: failure

View job details

##[group]Removing auth
 Removing SSH command configuration
 [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
 [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
 Removing HTTP extra header
 [command]/usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
 [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
 Removing includeIf entries pointing to credentials config files
 [command]/usr/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir:
 includeif.gitdir:/home/runner/work/vyos-documentation/vyos-documentation/reviewer/.git.path
 includeif.gitdir:/home/runner/work/vyos-documentation/vyos-documentation/reviewer/.git/worktrees/*.path
 includeif.gitdir:/github/workspace/reviewer/.git.path
 includeif.gitdir:/github/workspace/reviewer/.git/worktrees/*.path
 [command]/usr/bin/git config --local --get-all includeif.gitdir:/home/runner/work/vyos-documentation/vyos-documentation/reviewer/.git.path
 /home/runner/work/_temp/git-credentials-8d361b58-b7b8-4b97-8cee-a44119fc5f88.config
 [command]/usr/bin/git config --local --unset includeif.gitdir:/home/runner/work/vyos-documentation/vyos-documentation/reviewer/.git.path /home/runner/work/_temp/git-credentials-8d361b58-b7b8-4b97-8cee-a44119fc5f88.config
 [command]/usr/bin/git config --local --get-all includeif.gitdir:/home/runner/work/vyos-documentation/vyos-documentation/reviewer/.git/worktrees/*.path
 /home/runner/work/_temp/git-credentials-8d361b58-b7b8-4b97-8cee-a44119fc5f88.config
 [command]/usr/bin/git config --local --unset includeif.gitdir:/home/runner/work/vyos-documentation/vyos-documentation/reviewer/.git/worktrees/*.path /home/runne...

---

GitHub Actions: AI Validation / 1_prepare.txt: T9229: adds documentation for sys-rawio

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m# Fetch the base branch explicitly by refname to avoid ambiguity with�[0m
 �[36;1m# same-named tags (e.g., a `rolling` tag), then diff against FETCH_HEAD.�[0m
 �[36;1mgit fetch --no-tags --depth=1 origin "refs/heads/rolling"�[0m
 �[36;1mBASE="FETCH_HEAD"�[0m
 �[36;1m# --diff-filter=ACMRT excludes Deleted entries so the bundling�[0m
 �[36;1m# loop below (`git show HEAD:<path>`) doesn't try to extract�[0m
 �[36;1m# blobs for files that no longer exist in the merge ref.�[0m
 �[36;1m# Deletions still appear in diff-md.patch (full diff) but not�[0m
 �[36;1m# in changed-md.txt (which drives the bundling step).�[0m
 �[36;1mgit diff "$BASE...HEAD" --name-only --diff-filter=ACMRT -z -- ':(glob)docs/**/*.md'  > changed-md.z�[0m
 �[36;1mgit diff "$BASE...HEAD" --name-only --diff-filter=ACMRT -z -- ':(glob)docs/**/*.rst' > changed-rst.z�[0m
 �[36;1m# Reject paths containing line-disrupting control bytes (LF, CR,�[0m
 �[36;1m# other 0x01-0x1F + 0x7F) before generating the newline-delimited�[0m
 �[36;1m# *.txt manifests. NUL itself can't appear in a git pathname�[0m
 �[36;1m# (it's the on-disk tree-entry terminator), so it stays out of�[0m
 �[36;1m# the rejection class and remains the legitimate record delimiter�[0m
 �[36;1m# for `git diff -z` — `grep -z` honors that contract.�[0m
 �[36;1m#�[0m
 �[36;1m# POSIX filesystems generally allow LF/CR in filenames and git�[0m
 �[36;1m# stores them fine; the hazard is purely in our line-delimited�[0m
 �[36;1m# downstream tooling. Without this guard, `tr '\0' '\n'` on a�[0m
 �[36;1m# path like `docs/foo\nbar.md` would split it into two logical�[0m
 �[36;1m# lines — downstream consumers reading line-by-line would miss�[0m
 �[36;1m# validation coverage on the real file (or worse, act on a�[0m
 �[36;1m# synthetic path). Fail fast at this seam.�[0m
 �[36;1m#�[0m
 �[36;1m# An earlier `tr -d '\0\n\r' | grep [\x00-\x1F\x7F]` form�[0m
 �[36;1m# stripped the very bytes it was m...

---

GitHub Actions: AI Validation / 0_validate.txt: T9229: adds documentation for sys-rawio

Conclusion: failure

View job details

##[group]Removing auth
 Removing SSH command configuration
 [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
 [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
 Removing HTTP extra header
 [command]/usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
 [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
 Removing includeIf entries pointing to credentials config files
 [command]/usr/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir:
 includeif.gitdir:/home/runner/work/vyos-documentation/vyos-documentation/reviewer/.git.path
 includeif.gitdir:/home/runner/work/vyos-documentation/vyos-documentation/reviewer/.git/worktrees/*.path
 includeif.gitdir:/github/workspace/reviewer/.git.path
 includeif.gitdir:/github/workspace/reviewer/.git/worktrees/*.path
 [command]/usr/bin/git config --local --get-all includeif.gitdir:/home/runner/work/vyos-documentation/vyos-documentation/reviewer/.git.path
 /home/runner/work/_temp/git-credentials-8d361b58-b7b8-4b97-8cee-a44119fc5f88.config
 [command]/usr/bin/git config --local --unset includeif.gitdir:/home/runner/work/vyos-documentation/vyos-documentation/reviewer/.git.path /home/runner/work/_temp/git-credentials-8d361b58-b7b8-4b97-8cee-a44119fc5f88.config
 [command]/usr/bin/git config --local --get-all includeif.gitdir:/home/runner/work/vyos-documentation/vyos-documentation/reviewer/.git/worktrees/*.path
 /home/runner/work/_temp/git-credentials-8d361b58-b7b8-4b97-8cee-a44119fc5f88.config
 [command]/usr/bin/git config --local --unset includeif.gitdir:/home/runner/work/vyos-documentation/vyos-documentation/reviewer/.git/worktrees/*.path /home/runne...

🧰 Additional context used

📓 Path-based instructions (2)

docs/**/*.md

📄 CodeRabbit inference engine (AGENTS.md)

docs/**/*.md: Canonical docs pages must be written as MyST Markdown (.md); edit existing pages in .md only and never use the old md- prefix for new pages.
Use {cfgcmd}, {opcmd}, and {cmdincludemd} fenced directives in MyST pages for VyOS command coverage; do not replace them with plain text or bash fences.
Use MyST ATX headings (#, ##, ###, etc.) in canonical pages; the RST heading hierarchy does not apply to .md sources.
In MyST pages, prefer single backticks for inline code; double backticks are reserved for embedded RST contexts.
Use % stop_vyoslinter and % start_vyoslinter comment markers in top-level MyST content to suppress real IPs or other allowed long-line exceptions, and keep them paired.
In MyST pages, write TODO markers as {todo} fenced directives.

Files:

• docs/configuration/container/index.md

docs/{_include/*.txt,**/*.md}

📄 CodeRabbit inference engine (AGENTS.md)

Keep documentation lines within 80 characters unless the content is inside a code block or fenced/preformatted block.

Files:

• docs/configuration/container/index.md

🧠 Learnings (13)

📚 Learning: 2026-05-06T20:48:49.689Z

Learnt from: andamasov
Repo: vyos/vyos-documentation PR: 1902
File: CLAUDE.md:71-71
Timestamp: 2026-05-06T20:48:49.689Z
Learning: In vyos/vyos-documentation, the 80-character line-length rule documented under Source conventions / Formatting applies only to documentation source files located under docs/ (e.g., docs/**/*.rst and docs/**/*.md). The rule is enforced by the vyoslinter (doc-linter.py from vyos/.github) when reviewing changed files via lint-doc.yml, and only for files within docs/**. Do not suggest hard-wrapping CLAUDE.md (repo-root documentation) because GitHub renders and reflows content. For CLAUDE.md, reviews should not enforce the 80-char wrapping; apply the rule only to files matching **/docs/**/*.{rst,md}.

Applied to files:

• docs/configuration/container/index.md

📚 Learning: 2026-05-06T20:48:57.970Z

Learnt from: andamasov
Repo: vyos/vyos-documentation PR: 1902
File: CLAUDE.md:91-93
Timestamp: 2026-05-06T20:48:57.970Z
Learning: The 80-character line limit applies only to documentation sources under docs/** (RST/MD). Do not enforce this limit on repo-root Markdown files like CLAUDE.md or README.md. The vyoslinter (doc-linter.py, run via lint-doc.yml from vyos/.github) lints only changed files within docs/**; root files are excluded. GitHub renders root Markdown with viewport-width reflow, so hard-wrapping these files reduces readability without tooling benefit.

Applied to files:

• docs/configuration/container/index.md

📚 Learning: 2026-05-06T20:48:50.446Z

Learnt from: andamasov
Repo: vyos/vyos-documentation PR: 1902
File: CLAUDE.md:64-64
Timestamp: 2026-05-06T20:48:50.446Z
Learning: Enforce the 80-character line-length limit only for documentation source files under docs/ (docs/**/*.md and docs/**/*.rst rendered by Sphinx and linted by vyoslinter via lint-doc.yml). Do not flag line-length issues in repository-root Markdown files such as CLAUDE.md or README.md, which GitHub renders with viewport-width reflow. This applies to all files within docs/ that are part of the documentation source.

Applied to files:

• docs/configuration/container/index.md

📚 Learning: 2026-05-06T20:48:54.578Z

Learnt from: andamasov
Repo: vyos/vyos-documentation PR: 1902
File: CLAUDE.md:80-84
Timestamp: 2026-05-06T20:48:54.578Z
Learning: Enforce the 80-character line-length limit only for documentation source files under docs/ (docs/**/*.rst and docs/**/*.md). Do not flag repo-root files like CLAUDE.md or README.md, since they are rendered by GitHub and not subject to this rule. The doc-linter (doc-linter.py via lint-doc.yml) only lints docs/**, so CI checks won't flag root files for line length.

Applied to files:

• docs/configuration/container/index.md

📚 Learning: 2026-05-06T20:49:00.044Z

Learnt from: andamasov
Repo: vyos/vyos-documentation PR: 1902
File: CLAUDE.md:108-108
Timestamp: 2026-05-06T20:49:00.044Z
Learning: Limit the 80-character line length check and vyoslinter (doc-linter.py) enforcement to documentation source files under docs/**/*.{rst,md}. Do not apply or flag line-length issues in repo-root files like CLAUDE.md or README.md, which are rendered directly by GitHub and are not linted by lint-doc.yml. This pattern narrows checks to Sphinx source docs and prevents false positives in non-doc files.

Applied to files:

• docs/configuration/container/index.md

📚 Learning: 2026-05-06T20:48:53.302Z

Learnt from: andamasov
Repo: vyos/vyos-documentation PR: 1902
File: CLAUDE.md:79-79
Timestamp: 2026-05-06T20:48:53.302Z
Learning: Limit line length to 80 characters only for documentation sources under the docs directory (docs/**/*.rst and docs/**/*.md). This is enforced by the vyoslinter doc-linter.py (from the vyos/.github repo) via lint-doc.yml on changed files under docs/**. Do not flag line-length violations in repository-root Markdown files like CLAUDE.md or README.md, as they are rendered by GitHub and reflow in the UI.

Applied to files:

• docs/configuration/container/index.md

📚 Learning: 2026-05-06T20:49:10.359Z

Learnt from: andamasov
Repo: vyos/vyos-documentation PR: 1902
File: CLAUDE.md:142-142
Timestamp: 2026-05-06T20:49:10.359Z
Learning: In vyos/vyos-documentation, the 80-character line limit and vyoslinter enforcement apply only to documentation source files under docs/**/*.rst and docs/**/*.md that Sphinx renders. Repo-root files such as CLAUDE.md and README.md are outside the linter's scope (lint-doc.yml runs on docs/**) and are rendered by GitHub with automatic paragraph reflow — do not flag line-length violations in these files.

Applied to files:

• docs/configuration/container/index.md

📚 Learning: 2026-05-06T20:49:15.361Z

Learnt from: andamasov
Repo: vyos/vyos-documentation PR: 1902
File: CLAUDE.md:163-163
Timestamp: 2026-05-06T20:49:15.361Z
Learning: In vyos/vyos-documentation, enforce the 80-character line-length limit (Source conventions / Formatting) only for Sphinx documentation source files under docs/**/*.rst and docs/**/*.md. The lint-doc.yml workflow runs the doc-linter (doc-linter.py) and checks only docs/** changed files. Files in the repository root (e.g., CLAUDE.md, README.md) are rendered by GitHub and are not subject to this rule; do not flag line-length violations in those files.

Applied to files:

• docs/configuration/container/index.md

📚 Learning: 2026-05-08T07:01:22.978Z

Learnt from: andamasov
Repo: vyos/vyos-documentation PR: 1878
File: docs/troubleshooting/connectivity.rst:0-0
Timestamp: 2026-05-08T07:01:22.978Z
Learning: For the VyOS documentation (MyST-based docs), MyST directive opener lines must keep the entire directive arguments on a single line. This includes MyST fenced-directive openers like ```{opcmd} ... ``` and the RST-equivalent form .. opcmd:: ... when ported/used in MyST. Because the MyST parser does not support wrapped/continued directive arguments across multiple lines, do not raise/keep review warnings suggesting line wrapping for these directive opener lines due to line-length (even if they exceed 80 characters).

Applied to files:

• docs/configuration/container/index.md

📚 Learning: 2026-05-08T07:01:22.978Z

Learnt from: andamasov
Repo: vyos/vyos-documentation PR: 1878
File: docs/troubleshooting/connectivity.rst:0-0
Timestamp: 2026-05-08T07:01:22.978Z
Learning: In vyos/vyos-documentation, do not raise line-length (>80 chars) review findings for MyST directive opener lines (the directive “opener” that uses MyST directive syntax such as `{cfgcmd}` / `{opcmd}` fence/openers). CI does not enforce the 80-character limit for these specific opener lines, and existing documentation contains longer opener lines that pass lint.

Applied to files:

• docs/configuration/container/index.md

📚 Learning: 2026-05-13T22:16:06.198Z

Learnt from: andamasov
Repo: vyos/vyos-documentation PR: 2021
File: docs/automation/terraform/terraformvyos.md:14-14
Timestamp: 2026-05-13T22:16:06.198Z
Learning: In the vyos/vyos-documentation repo, when a PR is a byte-for-byte documentation port of an existing file from the rolling branch to a release branch (e.g., circinus, sagitta), keep the port content identical to the production-tested rolling source. For these ports, do not raise new review findings for documentation issues that are already present in the rolling source (for example, markdownlint MD059 like non-descriptive link text such as `[link]`/`[install]`). Instead, defer those existing issues to a rolling-side cleanup PR (e.g., `#2024`) and then backport the cleanup via Mergify.

Applied to files:

• docs/configuration/container/index.md

📚 Learning: 2026-05-13T22:43:41.056Z

Learnt from: andamasov
Repo: vyos/vyos-documentation PR: 2024
File: docs/automation/terraform/terraformvyos.md:0-0
Timestamp: 2026-05-13T22:43:41.056Z
Learning: In docs/**/*.md, for Markdown reference definition lines of the form `[label]: <URL>`, if the line cannot be shortened to <= 80 characters (because the URL itself is near/at the limit), suppress the vyoslinter warning by wrapping only that reference definition with a `% stop_vyoslinter` / `% start_vyoslinter` block. If the reference definition can fit within 80 characters, leave it outside any suppression block.

Applied to files:

• docs/configuration/container/index.md

📚 Learning: 2026-06-05T19:21:44.474Z

Learnt from: LiudmylaNad
Repo: vyos/vyos-documentation PR: 2066
File: docs/configuration/protocols/traffic-engineering.md:0-0
Timestamp: 2026-06-05T19:21:44.474Z
Learning: In the vyos/vyos-documentation MyST documentation pages, when writing CLI example invocations directly under a `{cfgcmd}` directive, use `none` fenced code blocks for those examples. Do not change these example blocks to `{opcmd}` or `{cfgcmd}`—`{opcmd}` is reserved for operational-mode commands, and the surrounding `{cfgcmd}` directive already documents the target command. Plain `none` blocks for these CLI examples are intentional and correct.

Applied to files:

• docs/configuration/container/index.md

🔍 Remote MCP vyos.dev

Relevant task context

• T9229 — “Containers support sys-rawio capability” is Open with Low priority.
• Its requirement states that disk SMART monitoring in containers (e.g., Beszel) requires both SYS_ADMIN and SYS_RAWIO.
• The task comment explicitly requests adding sys-rawio and links to vyos-1x PR #5419.
• The task is currently in the “Need Triage” board column.

🔇 Additional comments (1)

docs/configuration/container/index.md (1)

237-237: LGTM!

---

📝 Walkthrough

Summary by CodeRabbit

• Documentation
  • Documented the sys-rawio container capability and its permission to perform raw I/O operations.

Walkthrough

Changes

Container capability documentation

Layer / File(s)	Summary
Document sys-rawio capability docs/configuration/container/index.md:237	The container capability list now includes sys-rawio and its raw I/O permission.

Merge Risk: ⚪ Minimal · up to c1396

This is a narrowly scoped documentation-only change with no actionable merge-blocking risk remaining after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the addition of documentation for the sys-rawio capability and includes the related task.
Description check	✅ Passed	The description provides related task and pull request references that connect it to the documentation change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

✨ Simplify code

• Create PR with simplified code

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sever-sever]

Add the sys-rawio capability

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[sever-sever]

@Mergifyio backport circinus

[mergify]

backport circinus

✅ Backports have been created

Details

• #2216 T9229: adds documentation for sys-rawio (backport #2215) has been created for branch circinus but encountered conflicts

Cherry-pick of c139696 has failed:

On branch mergify/bp/circinus/pr-2215
Your branch is up to date with 'origin/circinus'.

You are currently cherry-picking commit c1396965.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   docs/configuration/container/index.md

no changes added to commit (use "git add" and/or "git commit -a")

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally