Repository navigation
feat(backends): the measured routes from the egress proxy to a model server on the host (#503, 3/6) - #516
Merged
Conversation
edgehero
force-pushed
the
feat/503-host-routes
branch
2 times, most recently
from
October 2, 2026 06:53
ac6ad40 to
6dd9457
Compare
…server on the host (#503) HOST_ROUTES in worker/src/backends.mjs records, per runtime, helper and exact measured version, which host an endpoint declares to reach a model server through the egress proxy, and what the proxy and the server need for it. Every row states only what the 2026-09-30 measurements on #503 and their addendum publish. It is a reachability fact kept apart from BACKENDS: no declaration word, never read by the floor, and it refuses nothing. Doctor and the proxy do not read it yet. hostRouteFor takes a host as the endpoints parser stores it. Only three things read works or refuted: a host-local address (refuted on every runtime), the two alias names, and an IPv4 address in the host's own address list. Another address or name is lan, an ordinary outbound route that is never works. Anything else is unmeasured. PROXY_LOCAL_ADDRESSES is the one host-local set. model-endpoints.mjs builds LOCAL_ADDRESSES from it and now also refuses a declared 10.0.2.2, which the rendered deny always blocked. docs/backends.md and docs/podman.md generate their tables from the source. Specs: DES-PODMAN-NATIVE-ROOTLESS-BACKEND, DES-CONTAINER-BACKEND-REGISTRY, INT-MODEL-ENDPOINTS-FILE-CONTRACT amended; INT-CONTAINER-RUNTIME-CONTRACT unchanged, checked. Signed-off-by: Rob Boerman <robboerman@live.nl>
edgehero
force-pushed
the
feat/503-host-routes
branch
from
October 2, 2026 07:16
6dd9457 to
d417e1f
Compare
This was referenced Oct 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #503: PR 3 of 6. This adds the measured routes from the egress proxy to a model server on the host, as data. Nothing reads them yet; doctor uses them in a later part.
What changes
worker/src/backends.mjsgains a frozenHOST_ROUTEStable, kept apart from the security declarations (enforced, asserted, absent), because a route is a reachability fact. It also gains a purehostRouteFor(runtime, endpointHost), which returns{status, sentence}. Any combination the table does not name readsunmeasured.host.docker.internalreaches even a loopback-only server, and nothing needs adding.host.docker.internalworks through--add-host host.docker.internal:host-gatewayon the proxy, with the server on 172.17.0.1 or 0.0.0.0. A host with UFW active is unmeasured.host.containers.internaland the host's own LAN address both work.host.containers.internal(169.254.1.2) works. The host's own LAN address is refuted.host.containers.internalis the network gateway, so the server must be on 0.0.0.0.docs/backends.mdanddocs/podman.mdgain a "Reaching a model server on the host" section. The rows are generated from the table by the doc tests.DES-PODMAN-NATIVE-ROOTLESS-BACKENDrecords the measured routes and refutes the "LAN endpoints only for Podman 4.x" fallback.DES-CONTAINER-BACKEND-REGISTRYrecords the separate table.Tests
hostRouteForcase per measured row; loopback is refuted on every runtime; 13 unnamed combinations read unmeasured.