docs(netns): the by-name path to frank-dragoon is verified from the consumer

open-notebook resolves frank-dragoon-halogen to 10.89.1.39, GET :8731/v1/models answers, and the engine logs the app's POST /v1/embeddings 200. That makes the 2026-10-19 dial census a pre-move record: pasta's forwarding rule is unchanged, the endpoint was moved out of pasta, so the 'menu is frank-tts + frank-archon' line is now past tense. Frontmatter date was still 2026-09-02 against October content; bumped.
2026-10-19 22:48:44 -07:00
parent af5a1f69a2
commit 1eebf3b129
1 changed files with 12 additions and 3 deletions
@@ -8,7 +8,7 @@ tags:
  - netavark
  - rootless
  - dankclaw
-timestamp: 2026-09-02
+timestamp: 2026-10-19
 ---

 # Container Network Namespaces
@@ -106,8 +106,8 @@ private `systemd-open-notebook`), each address aimed at a live listener:
 | `host.containers.internal:7771` (`169.254.1.2`) | **200** | the gateway alias is the one address that carries a rootless container to a host-netns listener. Why `hermes-dashboard` timed out on this alias in 2026-09-02 while `open-notebook` answers today is **not established**; the difference to check first is the second network and where the default route lands |
 | `192.168.0.235:7770` (`frank-archon`) | **200** | a different machine: plain routing, no DNAT in the path |

-The consequence that changes designs: **a rootless container's menu of local model
-endpoints is `frank-tts` (container DNS, same network) and `frank-archon` (LAN
+The consequence that changed designs: **a rootless container's menu of local model
+endpoints was only `frank-tts` (container DNS, same network) and `frank-archon` (LAN
 address on another host).** A `pasta` endpoint has no address an app container can
 use: the LAN address is refused, and the one alias that answers is link-local,
 which some applications refuse to store at all ([[Open Notebook]] meets exactly
@@ -127,6 +127,15 @@ API port becomes name-resolvable, which is the same trust the published 7770
 already carries on the LAN. `frank-zealot` (7771) stays a host-netns binary and
 remains unreachable except through the link-local alias.

+The move is verified from the consumer side, so the table above reads as the
+**pre-move** census and not as today's menu: inside `open-notebook`,
+`getent hosts frank-dragoon-halogen` → `10.89.1.39`, `GET :8731/v1/models`
+lists both served models, and the engine's log carries the app's
+`POST /v1/embeddings 200` from that address (2026-10-19) — see
+[[Open Notebook]] for what runs over it. What the table still owns is the
+pasta rule itself: nothing about pasta's forwarding changed, the endpoint was
+moved out of it.
+
 ## Operational rules

 - Health checks for a bridge-network service must target a **published** port (or