claude-hdb
a0400606c2
Two bugs, one in each direction. setup-host's new assertion ran 'nft list table bridge claudebox' without sudo. nft needs root, so it failed with permission denied and printed "the box-to-box drop is NOT active" about a rule that was demonstrably there. A check that cries wolf is worse than no check. And the deeper one: every check so far has asked the CONFIG whether boxes are isolated. The config is a claim. Incus can accept security.port_isolation and the kernel can still leave 'isolated off' on the tap — and then boxes reach each other while every config in sight says they cannot. That is precisely the shape of the original bug: the ACL looked airtight and never saw the traffic. So the doctor now reads the kernel's own view — 'bridge -d link show' on claudenet's ports — and reports the isolated flag as the fact it is. If the profile says true and the kernel says off, we learn that in a second instead of after another ten-minute drill. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| claudebox-firewall.service | ||
| claudebox-firewall.sh | ||
| setup-host.sh | ||
| teardown-host.sh | ||