stacklok / toolhive / 29580168217

69%

Build Type

push

github

Committed by web-flow

Commit Message

Reconcile network isolation with network mode (#5794)

* Reconcile network isolation with network mode

Network isolation is a bridge-topology construct: it builds a
per-workload internal-only network plus DNS and egress/ingress Squid
sidecars, and only works when the container lives on a Docker-managed
bridge. Since isolation became the default (v0.30.1), running a server
with --network host silently built those sidecars attached only to the
internal network with no route out, so all DNS and outbound traffic
broke on the next re-create. --network none hit the same path.

Isolation cannot be enforced for host/none/custom modes, so drop it
there instead of building broken sidecars. How loudly depends on
provenance: warn when isolation was on only by default (restores the
pre-v0.30.1 behaviour host-mode servers relied on), fail fast when the
user explicitly passed --isolate-network=true (a genuinely
contradictory request). "none" is already maximally confined, so its
drop is silent. The rule is enforced at three layers so no path can
report a workload started with non-functional isolation: the docker
client (structural backstop for every caller), the config builder
(owns the warn-vs-error decision, the only place that knows whether the
flag was explicit), and config load (self-heals legacy persisted
configs on restart, which bypass the builder).

Docker/Podman only; the Kubernetes runtime ignores both fields.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Stabilize Redis lazy-eviction E2E initialization

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Alejandro Ponce de Leon <aponcedeleonch@stacklok.com>

Coverage Stats

87 of 93 new or added lines in 6 files covered. (93.55%)

16 existing lines in 6 files now uncovered.

74415 of 108710 relevant lines covered (68.45%)

64.36 hits per line