Third obstacle in the blackbox deploy chain, each proved live 2026-10-21:
Exec duplicated the entrypoint. The image's ENTRYPOINT is /bin/blackbox_exporter; Exec= repeating the binary made it a positional arg - unexpected /bin/blackbox_exporter, crash loop. Exec now carries flags only.
The gateway bind was impossible.169.254.1.2 exists only inside each rootless netns; from the host netns it is bind: cannot assign requested address. The scrape path never needed it: a bridge container dialing the gateway lands on the host loopback - proved 200 from inside the prometheus container against a loopback bind. Exporter now binds 127.0.0.1 + LAN.
HealthCmd shell form broke argv./bin/sh -c "..." arrives as one quoted token and quadlet folded the following --health-interval/--health-retries (and the image name) into the command string. Now the plain exec form every sibling unit uses.
Docs: Prometheus.md bind law corrected (gateway = forward-to-loopback, not bind address); deploy gate stays loopback, which is now honest.
Test plan
One-shot podman run with the exact generated argv: 200 on loopback, LAN, and the gateway path from the prometheus container
deploy.sh dankclaw five-service chain green through the e2e gate
## Summary
Third obstacle in the blackbox deploy chain, each proved live 2026-10-21:
- **Exec duplicated the entrypoint.** The image's `ENTRYPOINT` is `/bin/blackbox_exporter`; `Exec=` repeating the binary made it a positional arg - `unexpected /bin/blackbox_exporter`, crash loop. Exec now carries flags only.
- **The gateway bind was impossible.** `169.254.1.2` exists only inside each rootless netns; from the host netns it is `bind: cannot assign requested address`. The scrape path never needed it: a bridge container dialing the gateway lands on the host **loopback** - proved 200 from inside the prometheus container against a loopback bind. Exporter now binds `127.0.0.1` + LAN.
- **`HealthCmd` shell form broke argv.** `/bin/sh -c "..."` arrives as one quoted token and quadlet folded the following `--health-interval`/`--health-retries` (and the image name) into the command string. Now the plain exec form every sibling unit uses.
Docs: Prometheus.md bind law corrected (gateway = forward-to-loopback, not bind address); deploy gate stays loopback, which is now honest.
## Test plan
- [x] One-shot `podman run` with the exact generated argv: 200 on loopback, LAN, and the gateway path from the prometheus container
- [ ] `deploy.sh dankclaw` five-service chain green through the e2e gate
---
cwd: /home/blank/Projects/serverAppConfig · session: wt-20261020-125416-6d1fc1f
Three stacked lessons, each proved live 2026-10-21:
- the image's ENTRYPOINT is /bin/blackbox_exporter, so Exec= repeating the
binary made it a positional arg: 'unexpected /bin/blackbox_exporter'.
- the podman gateway 169.254.1.2 is NOT bindable from the host netns - it
exists only inside each rootless netns: 'bind: cannot assign requested
address'. The scrape path does not need it bound: a bridge container
dialing the gateway lands on the host LOOPBACK (proved 200 from the
prometheus container), so the exporter binds 127.0.0.1 + LAN.
- HealthCmd shell form ('/bin/sh -c "..."') is passed as one quoted token
and quadlet folds the following --health-interval/--health-retries (and
the image) into the command string; the plain exec form the sibling units
use is correct.
Prometheus.md bind law corrected (gateway is a forward-to-loopback, not a
bind address); deploy-remote gate stays loopback, which is now honest.
dank
merged commit c4623f1629 into main2026-10-21 16:25:32 -07:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Third obstacle in the blackbox deploy chain, each proved live 2026-10-21:
ENTRYPOINTis/bin/blackbox_exporter;Exec=repeating the binary made it a positional arg -unexpected /bin/blackbox_exporter, crash loop. Exec now carries flags only.169.254.1.2exists only inside each rootless netns; from the host netns it isbind: cannot assign requested address. The scrape path never needed it: a bridge container dialing the gateway lands on the host loopback - proved 200 from inside the prometheus container against a loopback bind. Exporter now binds127.0.0.1+ LAN.HealthCmdshell form broke argv./bin/sh -c "..."arrives as one quoted token and quadlet folded the following--health-interval/--health-retries(and the image name) into the command string. Now the plain exec form every sibling unit uses.Docs: Prometheus.md bind law corrected (gateway = forward-to-loopback, not bind address); deploy gate stays loopback, which is now honest.
Test plan
podman runwith the exact generated argv: 200 on loopback, LAN, and the gateway path from the prometheus containerdeploy.sh dankclawfive-service chain green through the e2e gatecwd: /home/blank/Projects/serverAppConfig · session: wt-20261020-125416-6d1fc1f
Three stacked lessons, each proved live 2026-10-21: - the image's ENTRYPOINT is /bin/blackbox_exporter, so Exec= repeating the binary made it a positional arg: 'unexpected /bin/blackbox_exporter'. - the podman gateway 169.254.1.2 is NOT bindable from the host netns - it exists only inside each rootless netns: 'bind: cannot assign requested address'. The scrape path does not need it bound: a bridge container dialing the gateway lands on the host LOOPBACK (proved 200 from the prometheus container), so the exporter binds 127.0.0.1 + LAN. - HealthCmd shell form ('/bin/sh -c "..."') is passed as one quoted token and quadlet folds the following --health-interval/--health-retries (and the image) into the command string; the plain exec form the sibling units use is correct. Prometheus.md bind law corrected (gateway is a forward-to-loopback, not a bind address); deploy-remote gate stays loopback, which is now honest.