mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-10 21:07:03 +01:00
Krzysztof kuhy Rudnicki
334c0cd904
Some checks are pending
dependency freshness / dependencies on newest stable (push) Waiting to run
md-naming / markdown naming convention (push) Waiting to run
Pre-commit checks / pre-commit (push) Waiting to run
Shell tests / shell-tests (push) Waiting to run
Shell tests / arch-tests (push) Waiting to run
`write_nftables_ruleset` emitted a forward chain with `policy drop` and no rules at all. That chain runs at the same netfilter hook as Docker's own DOCKER-USER/DOCKER-FORWARD chains, so it vetoed them: every bridged container lost outbound networking while the host itself stayed online, so nothing looked broken. It cost the Signal bot three silent hours today. signal-cli lost its connection to Signal at 15:32:50 and looped on reconnect for 2.5h, while the bot kept answering /healthz with 200 -- `/v1/groups` still served from local state, so every surface said healthy. `flush ruleset` also deletes Docker's own tables, and dockerd only rebuilds them on its next network event, so restore_docker_rules() now restarts docker right after a successful apply. Verified in vmbox (Arch guest, docker installed, alpine probe): BASELINE=reachable -> OLD=blocked -> NEW=reachable, sshd active throughout. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KbjfWdAyHbCubac7wJKJZW |
||
|---|---|---|
| .. | ||
| explanations | ||
| superpowers | ||
| DOCS-agent-harness-evaluation-2026-08-18.md | ||
| DOCS-app-split-recipes.md | ||
| DOCS-device-owner-research.md | ||
| DOCS-dns-filtering-parked.md | ||
| DOCS-kcov-under-report.md | ||
| DOCS-python-split-recipes.md | ||
| DOCS-restructure-live-state.md | ||
| DOCS-shared-checkout-safety.md | ||
| DOCS-shell-split-harness.md | ||
| DOCS-shell-split-recipes.md | ||
| DOCS-shell-split-verification.md | ||
| DOCS-syncyomi-restore-runbook.md | ||
| mcp-shortlist.html | ||