fix(cli): restart the agent after restart-proxy so its netns re-links to wg-client - #93
Open
shejnowicz wants to merge 1 commit into
Open
fix(cli): restart the agent after restart-proxy so its netns re-links to wg-client#93shejnowicz wants to merge 1 commit into
shejnowicz wants to merge 1 commit into
Conversation
… to wg-client sandcat restart-proxy restarted mitmproxy and wg-client but left the agent container running. The agent uses `network_mode: service:wg-client`, which Docker resolves to a specific network-namespace file descriptor at agent-container start time. Restarting wg-client tears down that namespace and creates a fresh one, but the agent's existing fd still points at the torn-down namespace — so DNS and all outbound connectivity break inside the agent even though wg-client and mitmproxy are healthy. Re-link by restarting the agent after wg-client comes back healthy, so Docker resolves the netns reference against the fresh wg-client on container start. Guarded by the agent's pre-restart running status, so the netns re-link is a no-op when only the proxy stack is up (e.g. detached IDE session, agent stopped manually). Fixes #69. Verified end-to-end: with the fix, `curl https://github.com` from inside the agent still returns 200 after `sandcat restart-proxy`, matching the pre-restart behaviour. Without the fix the same command fails with "Could not resolve host: github.com" (reproduced against the tip of master before the change). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
5 tasks
Member
|
Since we restart both the proxy and the agent, that's like a total restart? So maybe we should drop this option, or just rename it to |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #69.
Summary
`sandcat restart-proxy` restarted `mitmproxy` and `wg-client` but left the `agent` container running. The agent uses `network_mode: service:wg-client`, which Docker resolves to a specific network-namespace file descriptor at agent-container start time. Restarting `wg-client` tears down that namespace and creates a fresh one, but the agent's existing fd still points at the torn-down namespace — so DNS and all outbound connectivity break inside the agent even though both proxy services are healthy.
Fix: after `wg-client` restart completes and reports healthy, also restart `agent`. Docker re-resolves the `network_mode` reference against the fresh `wg-client` on start, so the agent picks up a working netns.
The netns re-link is guarded by the agent's pre-restart running status, so `restart-proxy` on a proxy-only stack (agent stopped manually or never started) doesn't spontaneously start it.
Test plan
🤖 Generated with Claude Code