@celilo/e2e 0.18.0 → 0.19.0

package/config/routing/fw-isp-routes.sh

@@ -24,9 +24,19 @@ iptables -P FORWARD ACCEPT
 # DNS
 echo "nameserver 203.0.113.1" > /etc/resolv.conf
 
-# Start dnsmasq DHCP server on internal network
-dnsmasq --conf-dir=/etc/dnsmasq.d --keep-in-foreground --log-facility=- &
-echo "dnsmasq DHCP server started"
+# Start dnsmasq DHCP server on internal network.
+#
+# Skippable, because celilo can serve DHCP itself (`modules/dnsmasq-dhcp`) and
+# two DHCP servers on one broadcast domain race: whichever answers a DISCOVER
+# first wins, and a test asserting which one served a lease would be asserting
+# a coin toss. An operator moving DHCP to celilo turns the router's off, so a
+# suite that tests celilo's DHCP models that by setting ROUTER_DHCP=off.
+if [ "${ROUTER_DHCP:-on}" = "off" ]; then
+  echo "dnsmasq DHCP server NOT started (ROUTER_DHCP=off; celilo serves DHCP here)"
+else
+  dnsmasq --conf-dir=/etc/dnsmasq.d --keep-in-foreground --log-facility=- &
+  echo "dnsmasq DHCP server started"
+fi
 
 # Start greenwave simulator
 if [ -f /simulator/server.ts ]; then

package/docker/Dockerfile.management

@@ -35,6 +35,12 @@ RUN apt-get update && apt-get install -y \
     procps \
     zsh \
     gnupg \
+    # The hook jail (openspec/changes/hook-process-boundary, stage 2) runs every
+    # hook under bubblewrap. Without it the management box runs hooks unjailed,
+    # which is a valid mode but not the one the e2e suite is there to exercise.
+    # The container needs security_opt relaxations to let it build a namespace —
+    # see the measured ladder in docker-compose-generator.ts.
+    bubblewrap \
     && rm -rf /var/lib/apt/lists/*
 
 # --- Terraform, plus an OFFLINE provider mirror -------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/e2e",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "E2E test infrastructure for Celilo-deployed applications. Provides a simulated internet with DNS hierarchy, ACME server, firewalls, and target machines in Docker.",
   "type": "module",
   "main": "./src/index.ts",
@@ -37,7 +37,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@celilo/capabilities": "^3.0.0",
+    "@celilo/capabilities": "^3.1.0",
     "@celilo/cli-display": "^0.2.0",
     "@celilo/event-bus": "^0.6.0",
     "@celilo/terraform-fake": "^0.3.1",

package/src/container-manager.ts

@@ -1264,8 +1264,14 @@ export async function startNetwork(config: NetworkConfig): Promise<NetworkHandle
     );
   }
 
-  // Wait for DHCP client lease
-  if (config.dhcpClient) {
+  // Wait for DHCP client lease.
+  //
+  // Skipped when the router's DHCP is off, because then NOTHING is serving yet:
+  // celilo's own DHCP server is a module, and modules deploy long after the
+  // network is up. Waiting here would time out at 60s on every such suite and
+  // report it as a network-start failure. Those suites drive the client
+  // themselves once their server is deployed.
+  if (config.dhcpClient && config.routerDhcp !== false) {
     console.log('[progress:start] waiting for DHCP client lease | DHCP lease acquired');
     // Self-diagnosing via waitFor's onTimeout (e2e-confidence #255): a DHCP-lease
     // timeout is an intermittent in-suite flake (passes solo). On timeout, dump

package/src/docker-compose-generator.ts

@@ -94,6 +94,12 @@ function baseService(opts: {
   environment?: Record<string, string>;
   tmpfs?: string[];
   privileged?: boolean;
+  /**
+   * Docker `security_opt` entries, e.g. `seccomp=unconfined`. Needed by the
+   * management box so the hook jail's bubblewrap can build a namespace inside
+   * a container — see the measured ladder at its call site.
+   */
+  security_opt?: string[];
   dns?: string[];
   /** Host devices to expose, e.g. `/dev/net/tun` for a userspace WireGuard tunnel. */
   devices?: string[];
@@ -215,7 +221,13 @@ function defaultTopologyServices(config: NetworkConfig): Record<string, unknown>
       volumes: ['ssh-keys:/ssh-keys:ro'],
       // Which real ISP router this sim stands in for. The protocol is identical
       // across the two; only the TR-181 vendor extension prefix differs.
-      environment: { ROUTER_VENDOR_PREFIX: config.routerVendorPrefix ?? 'X_GWS_' },
+      environment: {
+        ROUTER_VENDOR_PREFIX: config.routerVendorPrefix ?? 'X_GWS_',
+        // The simulated router serves DHCP on `internal` by default, which is
+        // what an operator's router does. A suite testing celilo's OWN DHCP
+        // turns it off, because two servers on one broadcast domain race.
+        ROUTER_DHCP: config.routerDhcp === false ? 'off' : 'on',
+      },
     }),
   };
 }
@@ -568,7 +580,34 @@ export function generateTestComposeYaml(config: NetworkConfig, celiloRoot?: stri
       image:
         variant === 'vanilla' ? 'celilo-e2e/management:vanilla' : 'celilo-e2e/management:latest',
       networks: { [zone]: { ipv4_address: ip } },
-      cap_add: ['NET_ADMIN'],
+      // SYS_ADMIN is for the hook jail, NET_ADMIN for the routing the box does
+      // anyway. See the security_opt block below for why both are here.
+      cap_add: ['NET_ADMIN', 'SYS_ADMIN'],
+      // The hook jail runs each hook under bubblewrap, which has to build a
+      // user namespace and then mount inside it. Docker denies that four
+      // separate ways, and every one of these is load-bearing — measured on a
+      // colima Ubuntu 24.04.1 VM (kernel 6.8.0-50,
+      // kernel.apparmor_restrict_unprivileged_userns=1), by removing one at a
+      // time from the working set:
+      //
+      //   drop seccomp=unconfined      -> bwrap: pivot_root: Operation not permitted
+      //   drop apparmor=unconfined     -> bwrap: Failed to make / slave: Permission denied
+      //   drop systempaths=unconfined  -> bwrap: Can't mount proc on /newroot/proc
+      //   drop SYS_ADMIN               -> bwrap: setting up uid map: Permission denied
+      //
+      // Deliberately NOT `privileged: true`, which design D8 measured as
+      // working and task 4.1 asked to improve on. It would also grant every
+      // capability and every host device; this set grants four named things.
+      //
+      // `systempaths=unconfined` is the one D8's ladder was missing: it unmasks
+      // the /proc paths Docker hides, which is why "all three" of the earlier
+      // options still failed on the proc mount.
+      //
+      // NOTE this makes the container a WEAK place to test the AppArmor
+      // profile: apparmor=unconfined means the restriction the profile exists
+      // to satisfy is not in force here. That gate is the celilo-builder probe
+      // on a real kernel, never this container.
+      security_opt: ['seccomp=unconfined', 'apparmor=unconfined', 'systempaths=unconfined'],
       // ISS-0157: `module import`'s `bun install` hard-links packages from the
       // bun cache into node_modules, which on overlayfs forces a copy-up + fsync
       // per file. On a slow/contended builder disk that storm blows past the

package/src/network-builder.ts

@@ -140,6 +140,23 @@ export class NetworkBuilder {
     return this;
   }
 
+  /**
+   * Stop the simulated ISP router serving DHCP on `internal`.
+   *
+   * For suites where CELILO serves DHCP (`modules/dnsmasq-dhcp`). Two servers
+   * on one broadcast domain race, so without this a lease assertion is a coin
+   * toss. It is also what an operator does when moving DHCP to celilo, so the
+   * suite models the migration rather than dodging a conflict.
+   *
+   * NOTE: `withDhcpClient()`'s start-up lease wait expects SOMETHING to answer.
+   * Pair this with a suite that deploys celilo's DHCP server, or the client
+   * gets no lease and the network never comes up.
+   */
+  withoutRouterDhcp(): this {
+    this.config.routerDhcp = false;
+    return this;
+  }
+
   /**
    * Add the Proxmox API simulator on `secure-mgmt`.
    *

package/src/types.ts

@@ -66,6 +66,19 @@ export interface NetworkConfig {
    * serves both rather than a near-duplicate second one.
    */
   routerVendorPrefix?: string;
+  /**
+   * Whether the simulated ISP router serves DHCP on `internal`. Defaults to
+   * true, which is what an operator's router does and what every existing suite
+   * relies on.
+   *
+   * Set false when celilo serves DHCP instead (`modules/dnsmasq-dhcp`). Two
+   * DHCP servers on one broadcast domain race — whichever answers a DISCOVER
+   * first wins — so a suite asserting WHICH server issued a lease would be
+   * asserting a coin toss. Turning the router's off is also what a real
+   * operator does when moving DHCP to celilo, so this models the migration
+   * rather than papering over a conflict.
+   */
+  routerDhcp?: boolean;
   /** Extra volume mounts for the management container (host:container format) */
   managementVolumes: string[];
   /** Include a DHCP client container on the internal network */