From 1eebf3b1293abeef618c476bddf607dce5812382 Mon Sep 17 00:00:00 2001 From: Frank Date: Mon, 19 Oct 2026 22:48:44 -0700 Subject: [PATCH] docs(netns): the by-name path to frank-dragoon is verified from the consumer open-notebook resolves frank-dragoon-halogen to 10.89.1.39, GET :8731/v1/models answers, and the engine logs the app's POST /v1/embeddings 200. That makes the 2026-10-19 dial census a pre-move record: pasta's forwarding rule is unchanged, the endpoint was moved out of pasta, so the 'menu is frank-tts + frank-archon' line is now past tense. Frontmatter date was still 2026-09-02 against October content; bumped. --- .../Architecture/Container Network Namespaces.md | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/serverAppConfigs-docs/Architecture/Container Network Namespaces.md b/serverAppConfigs-docs/Architecture/Container Network Namespaces.md index eaa574e..4b089f1 100644 --- a/serverAppConfigs-docs/Architecture/Container Network Namespaces.md +++ b/serverAppConfigs-docs/Architecture/Container Network Namespaces.md @@ -8,7 +8,7 @@ tags: - netavark - rootless - dankclaw -timestamp: 2026-09-02 +timestamp: 2026-10-19 --- # Container Network Namespaces @@ -106,8 +106,8 @@ private `systemd-open-notebook`), each address aimed at a live listener: | `host.containers.internal:7771` (`169.254.1.2`) | **200** | the gateway alias is the one address that carries a rootless container to a host-netns listener. Why `hermes-dashboard` timed out on this alias in 2026-09-02 while `open-notebook` answers today is **not established**; the difference to check first is the second network and where the default route lands | | `192.168.0.235:7770` (`frank-archon`) | **200** | a different machine: plain routing, no DNAT in the path | -The consequence that changes designs: **a rootless container's menu of local model -endpoints is `frank-tts` (container DNS, same network) and `frank-archon` (LAN +The consequence that changed designs: **a rootless container's menu of local model +endpoints was only `frank-tts` (container DNS, same network) and `frank-archon` (LAN address on another host).** A `pasta` endpoint has no address an app container can use: the LAN address is refused, and the one alias that answers is link-local, which some applications refuse to store at all ([[Open Notebook]] meets exactly @@ -127,6 +127,15 @@ API port becomes name-resolvable, which is the same trust the published 7770 already carries on the LAN. `frank-zealot` (7771) stays a host-netns binary and remains unreachable except through the link-local alias. +The move is verified from the consumer side, so the table above reads as the +**pre-move** census and not as today's menu: inside `open-notebook`, +`getent hosts frank-dragoon-halogen` → `10.89.1.39`, `GET :8731/v1/models` +lists both served models, and the engine's log carries the app's +`POST /v1/embeddings 200` from that address (2026-10-19) — see +[[Open Notebook]] for what runs over it. What the table still owns is the +pasta rule itself: nothing about pasta's forwarding changed, the endpoint was +moved out of it. + ## Operational rules - Health checks for a bridge-network service must target a **published** port (or