8000 fix(minimal): remove the range aliases and resolver dir on macOS undo by gominimal-aw-bot[bot] · Pull Request #2246 · gominimal/minimal · GitHub
[go: up one dir, main page]

Skip to content

fix(minimal): remove the range aliases and resolver dir on macOS undo - #2246

Merged
norrietaylor merged 5 commits into
mainfrom
inbox-patch/macos-undo-leftovers-df5d703da1f0aaaa
Oct 18, 2026
Merged

norrietaylor merged 5 commits into
mainfrom
inbox-patch/macos-undo-leftovers-df5d703da1f0aaaa

Conversation

@gominimal-aw-bot
@gominimal-aw-bot gominimal-aw-bot Bot commented Oct 17, 2026 •
Copy link
Copy Markdown
Contributor

Routing-Key: inbox-route/I_kwDOSUhdos8AAAABX3vRaA

The macOS min finalize-install --undo script left two of the step's
artefacts behind: the /etc/resolver directory its mkdir -p created
(it removed only the file inside), and the reserved-range /32
aliases the range unit adds to lo0, which stayed until the next
boot. The script now boots the unit out and takes each range address
off lo0 with a tolerant /sbin/ifconfig lo0 -alias, then removes
the resolver file followed by rmdir /etc/resolver — an empty-only
rmdir, so a directory holding another resolver's file stays. Both
steps tolerate what is already gone, keeping the undo idempotent and
clean-host-safe.

The aliases are not pulled from under a running VM: when a VM host
daemon runs (pgrep -x minvmd), the script leaves them on lo0 and
prints note: the loopback IPs boxes use stay on lo0 while a VM is running; stop every VM (run min stop, and end any minvmd process still running), then run min finalize-install --undo again. The check
matches any minvmd process on the host (another user's VM, a leftover
__krun-vmm), which min stop alone may not end, so the note says so.
The rest of the undo still runs and the script exits 0.

The removal takes off every alias in the reserved range, including one
the range program found already present and skipped; the range is
reserved, so this is documented rather than tracked.

docs/reference/cli-min.md says so, and the rationale HTML comment
under spec 18's --undo requirement is brought in line with the
requirement: it now lists the aliases in the reserved range (kept while
any VM runs) and the resolver directory among what the undo removes.

Verification

  • finalize_install_undo_succeeds_on_a_clean_host stubs pgrep: with
    it exiting 1 every range alias comes off lo0 (the ifconfig
    stand-in logs each call); with it exiting 0 the note is printed, no
    ifconfig call is made, the resolver file is still removed, and the
    script exits 0

  • finalize_install_undo_removes_what_the_step_installs asserts the
    range unit is booted out before the running-VM check and alias removal

  • cargo fmt --all --check --manifest-path target/Cargo.toml — clean

  • cargo clippy --workspace --all-targets --locked --manifest-path target/Cargo.toml -- -D warnings — clean

  • cargo test --locked --manifest-path target/Cargo.toml -p minimal — 523 passed, 1 failed: legacy_network_spellings_parse_with_hint, a pre-existing failure reproduced identically on pristine main (verified by stashing the change and recompiling); every resolver test passes

  • finalize_install_undo_removes_what_the_step_installs now asserts the alias for-loop, the -alias line and the rmdir /etc/resolver line verbatim; finalize_install_undo_succeeds_on_a_clean_host runs the macOS script end-to-end with an ifconfig stand-in and still exits 0

  • cargo run --bin min -- finalize-install --undo --show --script renders a well-formed removal script (the sandbox is Linux, so the rendered arm is the Linux one; the macOS arm is exercised by the tests above)

  • live-session: macos e2e (.github/workflows/ci-macos.yml)

Summary by CodeRabbit

  • Bug Fixes
    • On macOS, min finalize-install --undo now removes the reserved-range addresses it added to the loopback interface. It also removes the resolver directory when empty.
  • Documentation
    • Updated the CLI reference and networking specification to describe the undo behavior.

The macOS undo script left two of the step's artefacts behind: the
/etc/resolver directory its mkdir -p created and the /32 lo0 aliases
the range unit adds, which stayed until the next boot. Boot the unit
out, then take each alias off with a tolerant ifconfig -alias, and
rmdir /etc/resolver after removing the resolver file — an
empty-only rmdir, so another resolver's file keeps the directory.
Both undo tests cover the new lines, and the clean-host run stubs
ifconfig too.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@gominimal-aw-bot
gominimal-aw-bot Bot requested a review from a team as a code owner October 17, 2026 10:07
@gominimal-aw-bot gominimal-aw-bot Bot added the agent:fix Agentic fix PR eligible for review iteration; min-aw's worker-iterate gates on it. label Oct 17, 2026
@github-actions
Copy link
Copy Markdown
Contributor

Spec lint

docs/specs/18-spec-box-networking/18-spec-box-networking.md — 11 finding(s)

docs/specs/18-spec-box-networking/18-spec-box-networking.md:159: P004 NET-009 names test 'native_resolution_without_proxy_env', which was not found in the repository
docs/specs/18-spec-box-networking/18-spec-box-networking.md:339: P004 NET-040 names test 'fresh_install_own_ip_ingress_publishes_loopback', which was not found in the repository
docs/specs/18-spec-box-networking/18-spec-box-networking.md:344: P004 NET-041 names test 'installer_switch_binary_executable', which was not found in the repository
docs/specs/18-spec-box-networking/18-spec-box-networking.md:382: P004 NET-048 names test 'linux_amd64_manifest_ships_vm_stack', which was not found in the repository
docs/specs/18-spec-box-networking/18-spec-box-networking.md:387: P004 NET-049 names test 'fresh_linux_kvm_activate_local_minvmd', which was not found in the repository
docs/specs/18-spec-box-networking/18-spec-box-networking.md:392: P004 NET-050 names test 'linux_arm64_manifest_ships_vm_stack', which was not found in the repository
docs/specs/18-spec-box-networking/18-spec-box-networking.md:397: P004 NET-051 names test 'fresh_arm64_kvm_activate_local_minvmd', which was not found in the repository
docs/specs/18-spec-box-networking/18-spec-box-networking.md:722: P004 NET-139 names test 'vsock_rpc_refuses_non_host_cid', which was not found in the repository
docs/specs/18-spec-box-networking/18-spec-box-networking.md:739: P004 NET-132 names test 'proxy_sees_each_vm_box_by_its_switch_address', which was not found in the repository
docs/specs/18-spec-box-networking/18-spec-box-networking.md:765: P004 NET-134 names test 'deny_all_box_reaches_proxy_and_no_other_host_port', which was not found in the repository
docs/specs/18-spec-box-networking/18-spec-box-networking.md:789: P004 NET-107 names test 'session_outbound_request', which was not found in the repository

Advisory. None of this blocks the merge; the review decides.

Advisory, and never a merge gate. Linter: gominimal/foundry@aa954653, spec format: How Minimal Writes Specs.

@coderabbitai
coderabbitai Bot commented Oct 17, 2026 •
Copy link
Copy Markdown
Contributor

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Essentials
  • Run ID: e61da6f5-902b-42bc-9bbf-a60ab61b2944
📥 Commits

Reviewing files that changed from the base of the PR and between 21744cc and b364ce4.

📒 Files selected for processing: 3
  • crates/minimal/src/resolver.rs
  • docs/reference/cli-min.md
  • docs/specs/18-spec-box-networking/18-spec-box-networking.md

Included review availability: This review used your included allowance. 2 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📝 Walkthrough

The macOS undo script now removes reserved-range aliases from lo0 and attempts to remove /etc/resolver when empty. Tests check these cleanup steps, and the CLI reference and networking specification describe the updated behavior.

Changes: macOS Undo Cleanup

Layer / File(s) Summary
Undo cleanup and validation
crates/minimal/src/resolver.rs, docs/reference/cli-min.md, docs/specs/18-spec-box-networking/18-spec-box-networking.md
The undo script removes each usable reserved-range address from lo0 and attempts to remove /etc/resolver after deleting the resolver file. Tests check the alias removals and directory cleanup, and redirect the script’s absolute ifconfig path to a test stand-in. The CLI reference and specification describe the alias cleanup.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Low

Suggested reviewers: norrietaylor

Merge Risk: 🔵 Low · up to b364c

Undo may remove a reserved-range loopback address that was already in use, disrupting a local service on affected hosts. The risk is bounded to hosts with that address overlap.

Pre-merge checks: Passed 5
Check name Status Explanation
Docstring Coverage Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 1 files. (2 skipped: 2 …
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Title check Passed The title clearly and concisely describes the macOS undo cleanup for range aliases and the resolver directory. It follows the required Conventional Commit format.
Description check Passed The description is mostly complete. It explains the change, documents the macOS VM condition, lists extensive verification results, and notes the documentation updates. It uses a "Verification" headin…
Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 1 files. (2 skipped: 2 unsupported.)

Full details: Description check

Explanation

The description is mostly complete. It explains the change, documents the macOS VM condition, lists extensive verification results, and notes the documentation updates. It uses a "Verification" heading instead of the template's "Testing" heading and omits the checklist section, but the required information is otherwise present.

✨ Finishing Touches
📝 Generate docstrings
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

A rabbit checks the loopback lane,
And clears each alias from the chain.
The resolver folder, if bare,
Gets a tidy-up with care.
Then hops away beneath the moon.

Comment @coderabbitai help to get the list of available commands.

@norrietaylor norrietaylor changed the title fix: fix(minimal): remove the range aliases and resolver dir on macOS undo fix(minimal): remove the range aliases and resolver dir on macOS undo Oct 17, 2026
@gominimal-aw-bot gominimal-aw-bot Bot added the agent:resolve Consent gate: pr-conflict-resolver may rewrite this branch label Oct 17, 2026
…range aliases

The running-VM check matches every minvmd process, so the note now asks
to stop every VM and end any minvmd left running. Document that the undo
removes every alias in the reserved range, and assert that the range unit
is booted out before the aliases come off.
@norrietaylor
Copy link
Copy Markdown
Member

/review

1 similar comment
@norrietaylor
Copy link
Copy Markdown
Member

/review

@minimal-foundry
minimal-foundry Bot commented Oct 18, 2026 •
Copy link
Copy Markdown
Contributor

Approved: no findings at fee958caa3c2.

Nothing to do.

Clobber: none. Not checked: actual runtime behaviour under a real macOS host, which needs a build.

@norrietaylor
Copy link
Copy Markdown
Member

/review

@minimal-foundry minimal-foundry Bot left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

minimal-review — advisory review

Verdict COMMENT — No findings.

Panel: 2 of 3 personas ran (security, supply-chain); did not complete: correctness.

@minimal-foundry minimal-foundry Bot added the review:approved minimal-review approved the current head label Oct 18, 2026
@norrietaylor norrietaylor left a comment
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved on ARCH PASS at fee958c.

@norrietaylor
norrietaylor added this pull request to the merge queue Oct 18, 2026
Merged via the queue into main with commit 4e16307 Oct 18, 2026
38 checks passed
@norrietaylor
norrietaylor deleted the inbox-patch/macos-undo-leftovers-df5d703da1f0aaaa branch October 18, 2026 07:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

agent:fix Agentic fix PR eligible for review iteration; min-aw's worker-iterate gates on it. agent:resolve Consent gate: pr-conflict-resolver may rewrite this branch review:approved minimal-review approved the current head

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

0