0.6.0 setup-host leaves a stale ACL gateway carve-out when boxnet's subnet moved — fixed on main, evidence for cutting 0.6.1 #92

New issue

Closed

opened 2026-07-19 12:10:59 +00:00 by dan-claude-bot · 1 comment

dan-claude-bot commented

2026-07-19 12:10:59 +00:00

(Migrated from github.com)

Found by the 2026-07-19 release drill, on the exact path a new operator hits today.

What happened

On a host whose boxnet had moved off the default subnet (the #80 escape hatch — this host runs boxnet at 10.89.0.1/24), a fresh default-channel install (curl | bash, which resolves the latest release = 0.6.0) auto-ran that tree's setup-host. Result, per drill/doctor.sh:

DIRTY  the gateway carve-out (10.88.0.1/32) does NOT match boxnet's gateway (10.89.0.1)
       — box DNS to the gateway dies inside the 10.0.0.0/8 drop
       the bridge moved (#80's escape hatch) and the ACL did not follow

Every box minted on that host would have no DNS — the poisoned-host failure mode RUNS.md trap 10 warns about, except produced by the released installer on a clean run.

Already fixed on main

BOX_SUBNET=10.89.0.0/24 box setup-host from main (0.6.1-dev) converged the ACL in place; doctor then reads clean, and the full drill subsequently passed 85/0 on this host. So this is not a code request — it is drill evidence that:

0.6.1 should ship soon: the current latest release mis-configures #80-style hosts on the default install path, and the fix is already on main.
Until then, operators on a moved subnet should install with BOX_REF=main or re-run main's setup-host after a 0.6.0 install.

Filed so the 0.6.1 changelog can name the operator-visible symptom.

🤖 Filed from the release-drill session.

Found by the 2026-07-19 release drill, on the exact path a new operator hits today. ## What happened On a host whose `boxnet` had moved off the default subnet (the #80 escape hatch — this host runs `boxnet` at `10.89.0.1/24`), a fresh **default-channel install** (`curl | bash`, which resolves the latest release = `0.6.0`) auto-ran that tree's `setup-host`. Result, per `drill/doctor.sh`: ``` DIRTY the gateway carve-out (10.88.0.1/32) does NOT match boxnet's gateway (10.89.0.1) — box DNS to the gateway dies inside the 10.0.0.0/8 drop the bridge moved (#80's escape hatch) and the ACL did not follow ``` Every box minted on that host would have **no DNS** — the poisoned-host failure mode RUNS.md trap 10 warns about, except produced by the *released installer* on a clean run. ## Already fixed on main `BOX_SUBNET=10.89.0.0/24 box setup-host` from **main** (0.6.1-dev) converged the ACL in place; doctor then reads `clean`, and the full drill subsequently passed **85/0** on this host. So this is not a code request — it is drill evidence that: 1. **0.6.1 should ship soon**: the current latest release mis-configures #80-style hosts on the default install path, and the fix is already on main. 2. Until then, operators on a moved subnet should install with `BOX_REF=main` or re-run main's `setup-host` after a 0.6.0 install. Filed so the 0.6.1 changelog can name the operator-visible symptom. 🤖 Filed from the release-drill session.

dan-claude-bot commented

2026-07-19 15:48:07 +00:00

(Migrated from github.com)

0.7.0 is released — closing as shipped.

The default install channel (curl … install.sh | bash) now resolves 0.7.0, whose setup-host converges the ACL gateway carve-out with the live bridge — verified live twice on the drill host where 0.6.0 produced exactly this dirty state (doctor: DIRTY … 10.88.0.1/32 does NOT match boxnet's gateway (10.89.0.1) → after main's converge: clean, followed by an 85/0 full drill). Operators on a moved subnet who installed 0.6.0 can repair in place with box setup-host after upgrading.

Release verification for the record: release.yml run succeeded on the 0.7.0 tag, the release body is byte-identical to the stamped CHANGELOG section, and a fresh default-channel install landed versions/0.7.0 with box --version answering box 0.7.0.

🤖 From the release-drill session.

**0.7.0 is released** — closing as shipped. The default install channel (`curl … install.sh | bash`) now resolves 0.7.0, whose `setup-host` converges the ACL gateway carve-out with the live bridge — verified live twice on the drill host where 0.6.0 produced exactly this dirty state (doctor: `DIRTY … 10.88.0.1/32 does NOT match boxnet's gateway (10.89.0.1)` → after main's converge: `clean`, followed by an 85/0 full drill). Operators on a moved subnet who installed 0.6.0 can repair in place with `box setup-host` after upgrading. Release verification for the record: `release.yml` run succeeded on the `0.7.0` tag, the release body is byte-identical to the stamped CHANGELOG section, and a fresh default-channel install landed `versions/0.7.0` with `box --version` answering `box 0.7.0`. 🤖 From the release-drill session.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: heavy-duty/box#92

No description provided.