mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-10 21:07:03 +01:00
Krzysztof kuhy Rudnicki
334c0cd904
Some checks are pending
dependency freshness / dependencies on newest stable (push) Waiting to run
md-naming / markdown naming convention (push) Waiting to run
Pre-commit checks / pre-commit (push) Waiting to run
Shell tests / shell-tests (push) Waiting to run
Shell tests / arch-tests (push) Waiting to run
`write_nftables_ruleset` emitted a forward chain with `policy drop` and no rules at all. That chain runs at the same netfilter hook as Docker's own DOCKER-USER/DOCKER-FORWARD chains, so it vetoed them: every bridged container lost outbound networking while the host itself stayed online, so nothing looked broken. It cost the Signal bot three silent hours today. signal-cli lost its connection to Signal at 15:32:50 and looped on reconnect for 2.5h, while the bot kept answering /healthz with 200 -- `/v1/groups` still served from local state, so every surface said healthy. `flush ruleset` also deletes Docker's own tables, and dockerd only rebuilds them on its next network event, so restore_docker_rules() now restarts docker right after a successful apply. Verified in vmbox (Arch guest, docker installed, alpine probe): BASELINE=reachable -> OLD=blocked -> NEW=reachable, sshd active throughout. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KbjfWdAyHbCubac7wJKJZW |
||
|---|---|---|
| .. | ||
| .githooks | ||
| .github | ||
| boot_recovery | ||
| C/atop_agg | ||
| diagnostics | ||
| docs | ||
| dwm | ||
| features | ||
| feedback-appimage | ||
| fixes | ||
| fresh-install | ||
| gaming | ||
| i3 | ||
| i3blocks | ||
| installers | ||
| lib | ||
| meta | ||
| misc | ||
| periodic_background | ||
| tests | ||
| utils | ||
| zsh | ||
| .gitignore | ||
| install_core_system.sh | ||
| test_results.log | ||