fix(dns): retry DNS verification and extend proxy readiness wait for Jetson

[ericksoa]

Summary

• Fixes [Jentson Orin][aarch64] get error "getent hosts github.com returned empty (DNS not resolving) " #2017 — DNS verification fails on Jetson Orin (aarch64) due to a timing race between the DNS forwarder binding its UDP socket and the getent hosts check firing.
• Replaces the fixed sleep 2 after forwarder launch with a readiness poll (up to 10s) that sends a real DNS query via socat to confirm the forwarder is actually serving.
• Adds retry logic (3 attempts, 2s apart) to the getent hosts github.com verification so transient startup delays on slower hardware don't cause a spurious FAIL.

Regression risk

Low. Both changes degrade gracefully — if socat is missing or the probe fails, the script falls through with a warning (same as before, just slower). No changes to the forwarder, iptables rules, resolv.conf rewriting, or CoreDNS discovery. DNS failure remains a warning, not a fatal error.

Test plan

• Run nemoclaw onboard on Jetson Orin (aarch64) — all 4 DNS verification checks should pass
• Run nemoclaw onboard on x86 — verify no regression, readiness poll exits quickly (~1-2s)
• Test with a pod image that lacks socat — readiness poll should fall through with WARNING after 10s, getent retry should still pass
• Test with DNS genuinely broken — verify FAIL is reported after 3 retry attempts

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Replaced fixed startup delay with active DNS readiness checks and bounded retry loops for the DNS forwarder and runtime resolution.
  • Improved retry behavior and updated reporting when DNS remains unresponsive after multiple attempts, yielding more reliable network initialization and clearer warnings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 367eedd1-62ed-4c1e-a55c-c5ed032cd0e2

📥 Commits

Reviewing files that changed from the base of the PR and between 8eb88c4 and e54f995.

📒 Files selected for processing (1)

• scripts/setup-dns-proxy.sh

🚧 Files skipped from review as they are similar to previous changes (1)

• scripts/setup-dns-proxy.sh

---

📝 Walkthrough

Walkthrough

The scripts/setup-dns-proxy.sh script now uses an active readiness probe (socat-based DNS query) with up to 10 one-second attempts to detect the DNS forwarder at ${VETH_GW}:53. Sandbox DNS verification now retries getent hosts github.com up to 3 times with 2-second intervals and reports "empty after 3 attempts" on failure.

Changes

Cohort / File(s)	Summary
DNS readiness & sandbox verification scripts/setup-dns-proxy.sh	Replaced fixed sleep 2 with an active socat-based DNS probe (timeout 1, up to 10 attempts, 1s interval) to detect forwarder responses; added warning if still unresponsive. Replaced single getent hosts github.com check with up to 3 retries (2s interval) and updated failure message to "empty after 3 attempts".

Sequence Diagram(s)

sequenceDiagram
  participant Script as Setup Script
  participant Veth as VETH Gateway
  participant Forwarder as DNS Forwarder
  participant Sandbox as Sandbox Resolver (getent)
  participant External as External DNS (github.com)

  Script->>Veth: send crafted DNS query (socat, UDP:53)
  Veth->>Forwarder: forward UDP packet
  Forwarder-->>Script: UDP DNS response (or empty)
  alt response received
    Script->>Script: set ready flag, proceed
  else no response (repeat up to 10x)
    Script->>Script: retry probe (1s interval)
    Script-->>Script: emit warning if still unresponsive after 10 attempts
  end

  Script->>Sandbox: run `getent hosts github.com` (up to 3 attempts)
  Sandbox->>External: perform DNS resolution via forwarder
  External-->>Sandbox: DNS answer (or empty)
  alt resolved
    Sandbox-->>Script: success
  else empty after 3 attempts
    Sandbox-->>Script: failure ("empty after 3 attempts")
  end

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 I hopped and poked the DNS night,

with socat ears and patient sight.
Ten tiny pings to find the gate,
three soft tries to fetch GitHub's slate.
Hooray — the network's feeling light! 🥕✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: adding DNS verification retries and extending the DNS proxy readiness wait period specifically for Jetson hardware, which directly addresses the linked issue #2017.
Linked Issues check	✅ Passed	The PR implements all core requirements from issue #2017: replaces the fixed sleep with an active readiness probe (up to 10s via DNS query), adds retry logic for getent (3 attempts), and validates the fix on Jetson Orin as required.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to the DNS verification and proxy readiness improvements specified in issue #2017; no out-of-scope modifications were introduced.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/2017-jetson-dns-proxy-timing

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@scripts/setup-dns-proxy.sh`:
- Around line 167-168: Replace the non-portable sh -c "echo -ne '...'" probe
with a POSIX-safe printf invocation: in the line invoking socat with the DNS
packet (the sh -c ... | timeout 1 socat - UDP:${VETH_GW}:53 ...), use printf
'%b' with the same \xHH escapes (e.g. printf '%b'
'\x00\x1e\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x06google\x03com\x00\x00\x01\x00\x01')
piped into timeout/socat instead of echo -ne so the packet bytes are produced
reliably across /bin/sh implementations.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 0c334af9-b568-4265-b050-5e1c754a38d0

📥 Commits

Reviewing files that changed from the base of the PR and between 26a8f7a and 8eb88c4.

📒 Files selected for processing (1)

• scripts/setup-dns-proxy.sh