dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(frank-dragoon): put the endpoint on the app bridge so app containers can name it

Browse Source 
An endpoint on podman's rootless default (pasta) has no address another
container can use, measured on 2026-10-19 from inside open-notebook:

  - 192.168.0.143:7770            connection refused (pasta forwards the
                                  published port in the host netns; no netavark
                                  DNAT exists for traffic arriving from a
                                  rootless bridge)
  - host.containers.internal:7770 200, but the alias resolves to 169.254.1.2 —
                                  link-local, which open-notebook's URL guard
                                  refuses to store
  - frank-dragoon-halogen:8731    name unknown: different netns
  - --network pasta --network dankclaw_default
                                  "cannot set multiple networks without bridge
                                  network mode" — pasta cannot be added to

So reaching the NPU endpoints from an app container means moving the container
onto dankclaw_default (FRANK_DRAGOON_NETWORK; empty keeps today's shape). This
is not an exposure change: the engine's unauthenticated token port binds the
container's own loopback (/proc/net/tcp: 127.0.0.1:8730 against 0.0.0.0:8731),
so only the API port becomes name-resolvable — the same trust the published
7770 already carries on the LAN. The deployer refuses a network that does not
exist rather than starting a unit that restart-loops on it.

Co-Authored-By: omp <omp@dankclaw>
This commit is contained in:
Frank
2026-10-19 21:27:07 -07:00
co-authored by omp
parent 53ef121180
commit 346e1d22f4
4 changed files with 60 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/frank_dragoon_unit.bats
+23
View File
@@ -357,6 +357,8 @@ $(cat "$TEST_TMP/serve.log")"
npu_models="$(sed -nE 's/^HALOGEN_NPU_MODELS=(.*)$/\1/p' "$ENV_FILE")"
grep -qF "LLM_DRAGOON_NPU_DIR=\"\${LLM_DRAGOON_NPU_DIR:-$npu_dir}\"" "$DEPLOYER"
grep -qF "LLM_DRAGOON_NPU_MODELS=\"\${LLM_DRAGOON_NPU_MODELS:-$npu_models}\"" "$DEPLOYER"
net="$(sed -nE 's/^FRANK_DRAGOON_NETWORK=(.*)$/\1/p' "$ENV_FILE")"
grep -qF "LLM_DRAGOON_NETWORK=\"\${LLM_DRAGOON_NETWORK:-$net}\"" "$DEPLOYER"
}
@test "the deployer points a missing artifact at the v2abl fetch script" {
@@ -583,3 +585,24 @@ $(cat "$TEST_TMP/serve.log")"
# and curl drops Range across it (the sibling 62 GiB fetch, 2026-10-18).
grep -qE 'url_effective' "$NPU_FETCH"
}
@test "the container network is podman's default when unnamed and the app bridge when named" {
# The app-to-endpoint leg hangs on this: pasta is a private netns nothing
# else can join (podman refuses a second network, the published port is
# refused from app containers, and host.containers.internal is link-local,
# which open-notebook refuses to store), so reaching the NPU endpoints by
# name means the container lives on dankclaw_default. Both arms are
# observable in the command podman would run.
podman_stub
good_env
run_with_log FRANK_DRAGOON_NETWORK=
[ "$status" -eq 0 ]
! grep -q -- '--network' "$TEST_TMP/serve.log"
run_with_log FRANK_DRAGOON_NETWORK=dankclaw_default
[ "$status" -eq 0 ]
[[ "$output" == *"--network dankclaw_default"* ]]
# The deployer refuses a network that does not exist rather than starting a
# unit that restart-loops on it.
grep -qE 'podman network exists' "$DEPLOYER"
grep -qE '^FRANK_DRAGOON_NETWORK=dankclaw_default$' "$ENV_FILE"
}