stacklok / toolhive / 39337348365

73%

Build Type

push

github

Committed by web-flow

Commit Message

Merge commit from fork

* Protect Podman host endpoints in egress proxies

Podman host aliases can resolve outside bridge gateway addresses, allowing isolated workloads to reach host services without explicit permission.

Discover runtime-generated host mappings from the existing running DNS sidecar before proxy and workload startup. Protect their union with all bridge gateways in Squid and Envoy, failing closed when discovery is incomplete while preserving explicit port-independent host access.

Correct SDK transport option ordering for native Podman compatibility and add unit, race-tested, and native isolation regression coverage with deployment snapshot documentation.

Co-authored-by: Mecatl <noreply@mecatl.dev>

* Drop SDK option reorder now fixed upstream

The WithHost/WithHTTPClient reorder and its regression test landed
publicly in #6860. Restore these files to the fork base so this change
no longer touches them and the upstream version applies on merge.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Require only the Podman host alias in hosts

Discovery failed closed unless both host.containers.internal and
host.docker.internal were present. Older Podman releases only write
host.containers.internal, and an absent host.docker.internal cannot
resolve to the host, so requiring it only blocked deployments. Keep
protecting every alias that is present.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Mecatl <noreply@mecatl.dev>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Coverage Stats

84 of 87 new or added lines in 5 files covered. (96.55%)

7 existing lines in 2 files now uncovered.

87642 of 122670 relevant lines covered (71.45%)

126.61 hits per line