From cdd8b703ebc11bcf64ab0dac556081c68959950b Mon Sep 17 00:00:00 2001 From: claude-hdb Date: Tue, 14 Jul 2026 14:43:43 +0000 Subject: [PATCH] =?UTF-8?q?fix:=20box-net's=20NIC=20still=20pointed=20at?= =?UTF-8?q?=20claudenet=20=E2=80=94=20the=20drill=20caught=20it=20in=20sec?= =?UTF-8?q?onds?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The profile rename changed the file's name, header and limits but not the device's 'network:' field; the claudenet→boxnet sed covered host/*.sh only. On a wiped host (no claudenet to silently latch onto) 'incus profile edit box-net' refused the YAML and setup died — run 14's first catch, before a single box was minted. The sweep this fix rode in on found exactly one other stale reference, in the same file's comment. --- profiles/box-net.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/profiles/box-net.yaml b/profiles/box-net.yaml index 5c431ef..2fd9d76 100644 --- a/profiles/box-net.yaml +++ b/profiles/box-net.yaml @@ -9,7 +9,7 @@ config: {} devices: eth0: type: nic - network: claudenet + network: boxnet name: eth0 # Boxes must not reach each other. This is the mechanism that actually does # it: the kernel bridge's port-isolation flag, which stops two isolated @@ -18,7 +18,7 @@ devices: # It is not an ACL rule, and it cannot be. Incus ACLs are L3/L4, and two # boxes on one bridge are on the same L2 segment — their frames are switched # between ports and never traverse the netfilter path an ACL lives on. That - # is why the ACL's drop on 10.0.0.0/8 (which contains claudenet) and its + # is why the ACL's drop on 10.0.0.0/8 (which contains boxnet) and its # default ingress drop BOTH looked airtight while box→box was wide open: a # live probe found box A's SYN arriving at box B and B answering with a RST. security.port_isolation: "true"