From 26d81cd36e141ced194a5d0fc73221faa9397bce Mon Sep 17 00:00:00 2001 From: atlas Date: Mon, 15 Jun 2026 20:45:20 +0200 Subject: [PATCH] fix(harness): stop resolvconf/dhcpcd clobbering the bridge DNS resolver Under network isolation, agents lost DNS resolution of the hive's own zones (forge., matrix.): the hyperhive-isolated-dns oneshot points resolv.conf at the bridge resolver, but resolvconf regenerated it from host-tracking right after (dhcpcd re-triggering that when the veth comes up), reverting to the non-authoritative host resolver. Agents then couldn't reach the in-hive forge or matrix through the gateway, which broke an isolate-by-default rollout. Take resolvconf and dhcpcd out of the resolv.conf loop: disable resolvconf and tell dhcpcd not to touch resolv.conf (without disabling dhcpcd itself, so the veth still gets its address). Then the last writer owns it -- the nixos-container host-copy in shared netns, or the oneshot in isolated mode. Mirrors the approach the matrix container already takes. Eval-checked; flake check passes. --- nix/templates/harness-base.nix | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix index 80331efb..f5efd435 100644 --- a/nix/templates/harness-base.nix +++ b/nix/templates/harness-base.nix @@ -1025,6 +1025,21 @@ in # One-shot: tea config.yml from the seeded forge token. Shape # contract (always exit 0, no set -e, skip-silently, re-runnable): # docs/conventions.md::Best-effort oneshot services. + # Take resolvconf + dhcpcd out of the /etc/resolv.conf loop so the + # bridge resolver the oneshot below writes actually sticks. At their + # NixOS defaults, resolvconf regenerates resolv.conf from host-tracking + # *after* the oneshot has pointed it at the bridge (dhcpcd re-triggers + # that when the veth comes up under isolation) — silently clobbering the + # bridge nameserver back to the host resolver, which isn't authoritative + # for the hive's own zones, so `forge.` stops resolving. We + # disable resolvconf and tell dhcpcd not to touch resolv.conf (without + # disabling dhcpcd itself, so the veth still gets its address); then + # whoever wrote resolv.conf last owns it: the nixos-container host-copy + # in shared netns, or the oneshot in isolated mode. (Same "take + # resolvconf out of the loop" approach the matrix container uses.) + networking.resolvconf.enable = false; + networking.dhcpcd.extraConfig = "nohook resolv.conf"; + # Point resolv.conf at the hive bridge resolver when the container is # network-isolated. nixos-container copies the *host's* /etc/resolv.conf # into the container at every start — but the host resolver (e.g.