Skip to content

docs(arch-networking): minimald networking — PTask network modes, DNS, egress/ingress, WireGuard mesh - #484

Merged
norrietaylor merged 1 commit into
mainfrom
arch/networking-7ef437c26bf8f165
Jun 20, 2026
Merged

docs(arch-networking): minimald networking — PTask network modes, DNS, egress/ingress, WireGuard mesh#484
norrietaylor merged 1 commit into
mainfrom
arch/networking-7ef437c26bf8f165

Conversation

@gominimal-aw-bot

@gominimal-aw-bot gominimal-aw-bot Bot commented Jun 20, 2026

Copy link
Copy Markdown
Contributor

Chosen approach

Shared gvproxy switch per host. Trimodal NetworkMode enum (NoNet / HostNet / OwnIp) replaces sandbox2::Config::disable_networking: bool. Per-PTask switch attachment via SCM_RIGHTS fd-pass on DM2 (native Linux) and vsock shuttle on DM1/3/4 (libkrun VMs). Policy, DNS, and WireGuard mesh layers on top.

See docs/specs/03-spec-networking/architecture.md for the full record.

Related tracking issue: #478

ADR

No cross-cutting ADR. All decisions are scoped to the networking stack implementation.

Needs-spike items

Two needs-spike assumptions in the assumption ledger (spike sub-issues opened alongside this PR):

  1. dns-hostname-mechanism — whether *.localhost wildcard resolution works rootlessly on common Linux distributions, or whether a one-time /etc/resolver-equivalent setup step is needed. Blocks Unit 3.
  2. wireguard-implementation — wireguard-go (cgo, Go toolchain already needed for gvproxy) vs boringtun (pure Rust). Blocks Unit 4.

Next step

Please review and merge the architecture PR to advance tracking issue #478 to the plan phase (Unit decomposition). sdd-pr-sanitize will add Closes #483 to this body once both the sub-issue and this PR exist.

Generated by sdd-triage-arch for issue #478 ·

Closes #483

Summary by CodeRabbit

  • Documentation
    • Updated internal networking architecture specifications to document system design and infrastructure improvements.

Note: This update reflects internal technical documentation and specifications. No new user-facing features or functionality changes in this release.

Architecture for #478: shared gvproxy switch per host, trimodal
NetworkMode enum (NoNet/HostNet/OwnIp) replacing sandbox2's binary
disable_networking, per-PTask fd-pass attachment on DM2, policy and
DNS layers on top. Two needs-spike items: dns-hostname-mechanism
(*.localhost vs /etc/resolver) and wireguard-implementation
(wireguard-go vs boringtun).
@coderabbitai

coderabbitai Bot commented Jun 20, 2026

Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Walkthrough

Adds docs/specs/03-spec-networking/architecture.md, a new architecture specification defining the minimald networking model: a shared per-host gvproxy switch, a trimodal NetworkMode (NoNet/HostNet/OwnIp) replacing the prior boolean, Unit 2 egress/ingress policy via gvproxy HTTP API, Unit 3 DNS hostname registry, Unit 4 WireGuard mesh remote access, and enumerated cross-crate data/interface changes with alternatives, knowledge gaps, and an assumption ledger.

Changes

minimald Networking Architecture Specification

Layer / File(s) Summary
Document metadata
docs/specs/03-spec-networking/architecture.md
Adds front-matter, title, status, and issue tracking context for the new spec document.
Shared gvproxy switch and trimodal NetworkMode
docs/specs/03-spec-networking/architecture.md
Defines the shared per-host gvproxy switch, replaces disable_networking with NoNet/HostNet/OwnIp, and specifies OwnIp tap provisioning, switch attachment (SCM_RIGHTS fd-passing for DM2, vsock shuttle for DM1/DM3/DM4), per-subnet IP allocation/release, and gvproxy lifecycle ownership.
Unit 2: egress/ingress policy and GetSessionPolicy RPC
docs/specs/03-spec-networking/architecture.md
Defines EgressPolicy/IngressPolicy types, specifies application via gvproxy HTTP management endpoint with dynamic port mapping resolution, introduces GetSessionPolicy RPC, and describes DM2 UC5 collapse for VM-wide egress.
Unit 3: DNS hostname registry
docs/specs/03-spec-networking/architecture.md
Specifies session-keyed hostname registry format, write/remove lifecycle, resolved IP behavior by placement, and marks DNS resolution mechanism as an open decision.
Unit 4: WireGuard mesh and remote access
docs/specs/03-spec-networking/architecture.md
Defines optional WireGuard mesh joining/subnet routing, feature-flagged HTTPS reverse proxy (hyper/axum + rustls), and SSH port-forwarding fallback with explicit feature-flag dependency isolation.
Cross-crate data and module changes
docs/specs/03-spec-networking/architecture.md
Enumerates changes to sandbox2::Config, sessions::Record, minimald-rpc types/RPCs, new minimald net/ module tree, minvmd VM config vm_egress, and new minimal2 subcommands.
Alternatives, knowledge gaps, and assumption ledger
docs/specs/03-spec-networking/architecture.md
Rejects per-PTask gvproxy, pasta, and boolean alternatives with rationale; lists knowledge gaps and missing artifacts; defines the assumption ledger with open WireGuard and DNS decision items.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~15 minutes

Possibly related issues

  • epic: minimald networking — PTask network modes, DNS, egress/ingress, WireGuard mesh #478: This PR directly implements the architecture deliverable for the minimald networking epic, covering all specified components: trimodal network modes, gvproxy switch, DNS, egress/ingress policy, and WireGuard mesh.
  • gominimal/inbox#245: The spec document addresses the same minimald networking system use cases, shared gvproxy model, and WireGuard remote access architecture described in that issue.

Possibly related PRs

  • gominimal/minimal#407: Directly connected through the shared gvproxy networking model, NetworkMode concept, and network policy enforcement that both PRs specify and/or wire.
  • gominimal/minimal#482: Advances the same "minimald networking" documentation spec covering the shared gvproxy switch, trimodal NetworkMode, Unit 2–4 design, and WireGuard/SSH remote access.

Suggested reviewers

  • norrietaylor

Poem

🐇 A spec has hopped in, fresh and new,
With gvproxy switches and modes times two—
No-net, host-net, own-IP too,
WireGuard meshes woven through!
The rabbit declares: the design is true. 🌐

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main content of the PR: a networking architecture specification covering network modes, DNS, and WireGuard mesh for minimald.
Linked Issues check ✅ Passed The PR documentation fully addresses the architecture deliverable objective from issue #483, covering network modes, switch attachment mechanisms, policy enforcement, DNS, and WireGuard mesh networking.
Out of Scope Changes check ✅ Passed All changes are focused on the networking architecture specification as required by the linked issue; no out-of-scope changes are present.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.


Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (2)
docs/specs/03-spec-networking/architecture.md (2)

177-177: 💤 Low value

Reword repeated "New" sentence openers for prose clarity.

Static analysis flagged three instances of successive sentences beginning with "New" (lines 177, 201–202), which slightly impacts readability:

  • Line 177: "New net/ module tree:"
  • Line 201: "New subcommand group mesh:"
  • Line 202: "New subcommand ssh-forward:"

Consider varying the phrasing (e.g., "Introduces," "Adds," "The new") to improve flow.

✨ Proposed rewording
 ### `crates/minimal2/src/`
 
-New subcommand group `mesh`: `join`, `leave`, `status` (Unit 4).
-New subcommand `ssh-forward` (Unit 4).
-New subcommand `session policy` (Unit 2).
+Adds subcommand group `mesh`: `join`, `leave`, `status` (Unit 4).
+Introduces subcommand `ssh-forward` (Unit 4).
+Provides subcommand `session policy` (Unit 2).

(Or similar variation to reduce consecutive "New" openers.)

Also applies to: 201-202

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/specs/03-spec-networking/architecture.md` at line 177, The documentation
file contains three consecutive sentences that begin with the word "New" (at
lines 177, 201, and 202), which reduces prose clarity. To fix this, reword these
sentence openers to vary the phrasing: change "New `net/` module tree:" on line
177, "New subcommand group `mesh`:" on line 201, and "New subcommand
`ssh-forward`:" on line 202 to use alternative phrasings such as "Introduces,"
"Adds," "The new," or other variations that improve the flow and readability of
the document.

Source: Linters/SAST tools


238-244: Note implementation dependency risk on spec-minvmd-networking-gvproxy (#404).

The knowledge gaps section (lines 238–244) identifies spec-minvmd-networking-gvproxy (#404) as foundational ("its NetworkMode enum, spawn_gvproxy, and check_network_policy stub are all re-usable") but also notes that "implementation has not landed yet" and the issue is still in sdd:triage.

This creates a sequencing risk: if #404's implementation diverges from the assumptions stated in this spec (e.g., gvproxy API surface, IP allocation strategy, lifecycle ownership), this spec may require revision before Unit 1 implementation begins.

Recommendation: Add a sequencing note in the assumption ledger or preamble clarifying that Unit 1 implementation should not begin until #404's implementation is landed and validated against the assumptions stated here.

Would you like me to add an explicit dependency tracking note to the spec's preamble or assumption ledger?

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/specs/03-spec-networking/architecture.md` around lines 238 - 244, Add a
sequencing note to the spec's preamble or assumption ledger section (before or
near the knowledge gaps section around lines 238-244) that explicitly documents
the implementation dependency on issue `#404` (spec-minvmd-networking-gvproxy).
The note should clearly state that Unit 1 implementation must not commence until
`#404`'s implementation is landed and the actual implementation is validated
against the assumptions stated in this spec regarding the NetworkMode enum,
spawn_gvproxy function, and check_network_policy stub interfaces. This will make
the sequencing risk explicit and prevent downstream work from proceeding on
assumptions that may diverge from the eventual implementation.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@docs/specs/03-spec-networking/architecture.md`:
- Line 177: The documentation file contains three consecutive sentences that
begin with the word "New" (at lines 177, 201, and 202), which reduces prose
clarity. To fix this, reword these sentence openers to vary the phrasing: change
"New `net/` module tree:" on line 177, "New subcommand group `mesh`:" on line
201, and "New subcommand `ssh-forward`:" on line 202 to use alternative
phrasings such as "Introduces," "Adds," "The new," or other variations that
improve the flow and readability of the document.
- Around line 238-244: Add a sequencing note to the spec's preamble or
assumption ledger section (before or near the knowledge gaps section around
lines 238-244) that explicitly documents the implementation dependency on issue
`#404` (spec-minvmd-networking-gvproxy). The note should clearly state that Unit 1
implementation must not commence until `#404`'s implementation is landed and the
actual implementation is validated against the assumptions stated in this spec
regarding the NetworkMode enum, spawn_gvproxy function, and check_network_policy
stub interfaces. This will make the sequencing risk explicit and prevent
downstream work from proceeding on assumptions that may diverge from the
eventual implementation.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 0ab2faea-f608-4365-8f74-97fb557a135c

📥 Commits

Reviewing files that changed from the base of the PR and between 5c17ece and 6159e6d.

📒 Files selected for processing (1)
  • docs/specs/03-spec-networking/architecture.md

@gominimal-aw-bot

Copy link
Copy Markdown
Contributor Author

sdd-validate — architecture boundary — PR #484

Resolved boundary: Architecture (docs/specs/03-spec-networking/architecture.md added — a new file under docs/specs/)

Gate set applied: Architecture gates


Gate 1 — Decision and rationale present: PASS
The chosen approach (shared gvproxy switch per host; trimodal NetworkMode enum replacing disable_networking: bool) is stated in the Chosen approach section. Each sub-choice — gvproxy topology, IP allocation, switch attachment mechanism per DM, gvproxy lifecycle pattern, Unit 4 proxy stack — carries its own rationale.

Gate 2 — Alternatives considered: PASS
Three alternatives are listed in the Alternatives considered section, each with explicit rejection reasoning:

  • Per-PTask gvproxy: rejected for UC6 bridging cost, macOS incompatibility, and proliferation of userspace stacks.
  • pasta for per-PTask Linux: rejected for no macOS support, no direct PTask-to-PTask routing.
  • Retaining disable_networking: bool with a separate OwnIp flag: rejected per Rust coding standards (illegal states unrepresentable).

Gate 3 — Consistent with existing decisions: PASS
No decisions/ ADRs exist in the repository. The knowledge gaps section confirms "Contradictions found: none." Referenced prior specs (arch-minvmd-host-daemon, spec-minvmd-networking-gvproxy #404) are cited as aligned; no reversal or conflict identified.

Gate 4 — No implementation detail masquerading as a decision: PASS
The record captures cross-cutting choices: gvproxy topology, NetworkMode API surface, egress/ingress policy model, DNS registration contract, WireGuard embedding approach. The Data and interface changes section specifies module paths (crates/minimald/src/net/mod.rs, net/policy.rs, etc.) and a builder method rename — these sit close to implementation detail but are grounded in the architectural choices above. Confidence in a Warning finding here is below the 80% floor; noted as an observation only.


Result: Architecture boundary — clean pass. All four architecture gates satisfied; no findings.

Note: Two needs-spike assumptions (dns-hostname-mechanism and wireguard-implementation) are correctly acknowledged as open questions requiring spike resolution before Unit 3 and Unit 4 implementation begins respectively. This is appropriate architectural practice and does not constitute a gate finding under any of the four architecture gates.

Generated by sdd-validate for issue #484 ·

@norrietaylor
norrietaylor enabled auto-merge (squash) June 20, 2026 05:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

architecture: minimald networking — PTask network modes, DNS, egress/ingress, WireGuard mesh

1 participant