fix(drill): read eth0 from inside the box; settle the flaky dns.mode verdict #21

Merged

dan-claude-bot merged 1 commit from drill/a3-and-flaky-dns into main

2026-07-13 22:41:57 +00:00

dan-claude-bot commented

2026-07-13 22:41:08 +00:00

(Migrated from github.com)

Run 3 scored 48/49. This PR fixes the last FAIL and one thing that is quietly worse than a FAIL.

The last FAIL: A3 was never a network finding, it was a parse bug

could not read peer's eth0 address — but run 3's own DNS note shows peer resolving to 10.87.0.210. The address was there all along. eth0_ip used incus list "^peer$", and incus name filters are not regexes, so the anchored form matched nothing. Three runs, one silent parse bug, and the single probe #12 hangs on never fired.

Now read from inside the box: ip -4 -o addr show dev eth0. No CSV quoting, no filter semantics, no ambiguity about which of a Docker-running box's addresses is the one on claudenet.

The thing that is worse than a FAIL: B3 flipped between runs

Run 2: B3 egress under dns.mode=none: BROKEN — design veto
Run 3: B3 egress under dns.mode=none: intact — safe to ship

A verdict that flips is a verdict you cannot design #16 on. Setting dns.mode restarts the network's dnsmasq, so a probe fired two seconds later can catch it mid-restart — run 2 caught it, run 3 didn't. The probe now distinguishes transient (recovers within 30s → shippable, and #16 must not probe DNS mid-restart) from broken (never recovers → genuine veto), and says which in the answers block.

If run 4 reports transient, my #16 comment claiming a design veto on dns.mode=none is wrong and I'll retract it — the knob is fine and the run-2 reading was an artifact.

Also

docker info was failing because a fresh exec session may not have picked up the docker group — not because of filtering. The check now probes the daemon with sudo and actually pulls and runs a container, which is the thing ipv4_filtering could plausibly break (docker0's egress). That closes B5's last unknown.

Re-run, same server:

cd claudebox && git pull && bash drill/drill.sh --yes

This run should answer A3 — the last open probe in #15 — and settle B3.

🤖 Generated with Claude Code

Run 3 scored **48/49**. This PR fixes the last FAIL and one thing that is quietly worse than a FAIL. ## The last FAIL: A3 was never a network finding, it was a parse bug `could not read peer's eth0 address` — but run 3's own DNS note shows `peer` resolving to **10.87.0.210**. The address was there all along. `eth0_ip` used `incus list "^peer$"`, and **incus name filters are not regexes**, so the anchored form matched nothing. Three runs, one silent parse bug, and the single probe #12 hangs on never fired. Now read from inside the box: `ip -4 -o addr show dev eth0`. No CSV quoting, no filter semantics, no ambiguity about which of a Docker-running box's addresses is the one on claudenet. ## The thing that is worse than a FAIL: B3 flipped between runs - Run 2: `B3 egress under dns.mode=none: BROKEN — design veto` - Run 3: `B3 egress under dns.mode=none: intact — safe to ship` **A verdict that flips is a verdict you cannot design #16 on.** Setting `dns.mode` restarts the network's dnsmasq, so a probe fired two seconds later can catch it mid-restart — run 2 caught it, run 3 didn't. The probe now distinguishes **transient** (recovers within 30s → shippable, and #16 must not probe DNS mid-restart) from **broken** (never recovers → genuine veto), and says which in the answers block. If run 4 reports transient, my #16 comment claiming a design veto on `dns.mode=none` is **wrong and I'll retract it** — the knob is fine and the run-2 reading was an artifact. ## Also `docker info` was failing because a fresh exec session may not have picked up the `docker` group — not because of filtering. The check now probes the daemon with `sudo` and actually **pulls and runs a container**, which is the thing `ipv4_filtering` could plausibly break (docker0's egress). That closes B5's last unknown. Re-run, same server: ```sh cd claudebox && git pull && bash drill/drill.sh --yes ``` This run should answer **A3 — the last open probe in #15** — and settle B3. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: heavy-duty/box#21

No description provided.