Repository navigation
fix(debug): make fs and portfw work as intended - #10
Merged
Merged
Conversation
fs: reading the container root via /proc/<pid>/root requires root or process ownership; when that fails it now falls back to running ls (or find, for recursive listings with --match) inside the container instead of erroring out, and the combined error names both attempts. portfw: the forward proxied each connection through host socat inside nsenter — failing when socat is missing, needing root but only failing silently per-connection, and forwarding to port 0 when flags were omitted. Connections are now dialed directly inside the container's network namespace in pure Go (setns on a dedicated locked thread, no socat/nsenter needed), namespace access is preflighted with an actionable needs-root error before the listener starts, --remote is the only required flag (--local defaults to it), and both directions tear down when either side closes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two more debug commands fixed for real-world (especially rootless) use:
fs —
/proc/<pid>/rootis only readable by the process owner or root; on stricter setups the command just errored. It now falls back to in-containerls/find(with--matchsupport), and failures name both attempts.portfw — was proxying through host
socatinsidensenter: broken without socat installed, needed root but failed silently per connection after printing "Forwarding…", and--local/--remoteomissions forwarded to port 0. Now: pure-Go dial inside the container's netns (setns on a dedicated locked thread — no external binaries), a preflight check that fails fast with "requires root — try sudo",--remoteas the only required flag (--localdefaults to it), and symmetric connection teardown.Verified live against rootless Podman 5.8.4:
fs --path /etcand--recursive --match "host*"list correctlyportfwfails fast with the actionable errorsudo portfw -R 8080 -l 9191: real traffic flowed through the tunnel (hello-through-forwardreceived from an in-container nc listener)go vet+go test -racegreen🤖 Generated with Claude Code