docs(arch-networking): minimald networking — PTask network modes, DNS, egress/ingress, WireGuard mesh - #484
Conversation
Architecture for #478: shared gvproxy switch per host, trimodal NetworkMode enum (NoNet/HostNet/OwnIp) replacing sandbox2's binary disable_networking, per-PTask fd-pass attachment on DM2, policy and DNS layers on top. Two needs-spike items: dns-hostname-mechanism (*.localhost vs /etc/resolver) and wireguard-implementation (wireguard-go vs boringtun).
📝 WalkthroughWalkthroughAdds Changesminimald Networking Architecture Specification
Estimated code review effort🎯 2 (Simple) | ⏱️ ~15 minutes Possibly related issues
Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
There was a problem hiding this comment.
🧹 Nitpick comments (2)
docs/specs/03-spec-networking/architecture.md (2)
177-177: 💤 Low valueReword repeated "New" sentence openers for prose clarity.
Static analysis flagged three instances of successive sentences beginning with "New" (lines 177, 201–202), which slightly impacts readability:
- Line 177: "New
net/module tree:"- Line 201: "New subcommand group
mesh:"- Line 202: "New subcommand
ssh-forward:"Consider varying the phrasing (e.g., "Introduces," "Adds," "The new") to improve flow.
✨ Proposed rewording
### `crates/minimal2/src/` -New subcommand group `mesh`: `join`, `leave`, `status` (Unit 4). -New subcommand `ssh-forward` (Unit 4). -New subcommand `session policy` (Unit 2). +Adds subcommand group `mesh`: `join`, `leave`, `status` (Unit 4). +Introduces subcommand `ssh-forward` (Unit 4). +Provides subcommand `session policy` (Unit 2).(Or similar variation to reduce consecutive "New" openers.)
Also applies to: 201-202
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/specs/03-spec-networking/architecture.md` at line 177, The documentation file contains three consecutive sentences that begin with the word "New" (at lines 177, 201, and 202), which reduces prose clarity. To fix this, reword these sentence openers to vary the phrasing: change "New `net/` module tree:" on line 177, "New subcommand group `mesh`:" on line 201, and "New subcommand `ssh-forward`:" on line 202 to use alternative phrasings such as "Introduces," "Adds," "The new," or other variations that improve the flow and readability of the document.Source: Linters/SAST tools
238-244: Note implementation dependency risk on spec-minvmd-networking-gvproxy (#404).The knowledge gaps section (lines 238–244) identifies
spec-minvmd-networking-gvproxy(#404) as foundational ("itsNetworkModeenum,spawn_gvproxy, andcheck_network_policystub are all re-usable") but also notes that "implementation has not landed yet" and the issue is still insdd:triage.This creates a sequencing risk: if
#404's implementation diverges from the assumptions stated in this spec (e.g., gvproxy API surface, IP allocation strategy, lifecycle ownership), this spec may require revision before Unit 1 implementation begins.Recommendation: Add a sequencing note in the assumption ledger or preamble clarifying that Unit 1 implementation should not begin until
#404's implementation is landed and validated against the assumptions stated here.Would you like me to add an explicit dependency tracking note to the spec's preamble or assumption ledger?
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/specs/03-spec-networking/architecture.md` around lines 238 - 244, Add a sequencing note to the spec's preamble or assumption ledger section (before or near the knowledge gaps section around lines 238-244) that explicitly documents the implementation dependency on issue `#404` (spec-minvmd-networking-gvproxy). The note should clearly state that Unit 1 implementation must not commence until `#404`'s implementation is landed and the actual implementation is validated against the assumptions stated in this spec regarding the NetworkMode enum, spawn_gvproxy function, and check_network_policy stub interfaces. This will make the sequencing risk explicit and prevent downstream work from proceeding on assumptions that may diverge from the eventual implementation.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@docs/specs/03-spec-networking/architecture.md`:
- Line 177: The documentation file contains three consecutive sentences that
begin with the word "New" (at lines 177, 201, and 202), which reduces prose
clarity. To fix this, reword these sentence openers to vary the phrasing: change
"New `net/` module tree:" on line 177, "New subcommand group `mesh`:" on line
201, and "New subcommand `ssh-forward`:" on line 202 to use alternative
phrasings such as "Introduces," "Adds," "The new," or other variations that
improve the flow and readability of the document.
- Around line 238-244: Add a sequencing note to the spec's preamble or
assumption ledger section (before or near the knowledge gaps section around
lines 238-244) that explicitly documents the implementation dependency on issue
`#404` (spec-minvmd-networking-gvproxy). The note should clearly state that Unit 1
implementation must not commence until `#404`'s implementation is landed and the
actual implementation is validated against the assumptions stated in this spec
regarding the NetworkMode enum, spawn_gvproxy function, and check_network_policy
stub interfaces. This will make the sequencing risk explicit and prevent
downstream work from proceeding on assumptions that may diverge from the
eventual implementation.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 0ab2faea-f608-4365-8f74-97fb557a135c
📒 Files selected for processing (1)
docs/specs/03-spec-networking/architecture.md
|
sdd-validate — architecture boundary — PR #484 Resolved boundary: Architecture ( Gate set applied: Architecture gates Gate 1 — Decision and rationale present: PASS Gate 2 — Alternatives considered: PASS
Gate 3 — Consistent with existing decisions: PASS Gate 4 — No implementation detail masquerading as a decision: PASS Result: Architecture boundary — clean pass. All four architecture gates satisfied; no findings. Note: Two
|
Chosen approach
Shared gvproxy switch per host. Trimodal
NetworkModeenum (NoNet/HostNet/OwnIp) replacessandbox2::Config::disable_networking: bool. Per-PTask switch attachment via SCM_RIGHTS fd-pass on DM2 (native Linux) and vsock shuttle on DM1/3/4 (libkrun VMs). Policy, DNS, and WireGuard mesh layers on top.See
docs/specs/03-spec-networking/architecture.mdfor the full record.Related tracking issue: #478
ADR
No cross-cutting ADR. All decisions are scoped to the networking stack implementation.
Needs-spike items
Two
needs-spikeassumptions in the assumption ledger (spike sub-issues opened alongside this PR):dns-hostname-mechanism— whether*.localhostwildcard resolution works rootlessly on common Linux distributions, or whether a one-time/etc/resolver-equivalent setup step is needed. Blocks Unit 3.wireguard-implementation— wireguard-go (cgo, Go toolchain already needed for gvproxy) vs boringtun (pure Rust). Blocks Unit 4.Next step
Please review and merge the architecture PR to advance tracking issue #478 to the plan phase (Unit decomposition).
sdd-pr-sanitizewill addCloses #483to this body once both the sub-issue and this PR exist.Closes #483
Summary by CodeRabbit
Note: This update reflects internal technical documentation and specifications. No new user-facing features or functionality changes in this release.