From 8eb88c4a034a55e5b8c94a308718485c14a36460 Mon Sep 17 00:00:00 2001 From: Aaron Erickson Date: Fri, 17 Apr 2026 13:30:25 -0700 Subject: [PATCH 1/2] fix(dns): retry DNS verification and extend proxy readiness wait for Jetson (Fixes #2017) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On Jetson Orin (aarch64), the Python DNS forwarder needs more time to bind the UDP socket after launch. The PID file is written before the socket is ready, so the old fixed `sleep 2` was insufficient — the getent verification fired before the forwarder could answer queries. Two changes: 1. Replace `sleep 2` with a readiness poll (up to 10s) that sends a real DNS query via socat to confirm the forwarder is serving. 2. Add retry logic (3 attempts, 2s apart) to the getent hosts verification check so transient startup delays don't cause a spurious FAIL. Co-Authored-By: Claude Opus 4.6 (1M context) --- scripts/setup-dns-proxy.sh | 28 +++++++++++++++++++++++++--- 1 file changed, 25 insertions(+), 3 deletions(-) diff --git a/scripts/setup-dns-proxy.sh b/scripts/setup-dns-proxy.sh index ea91066ec77..40af4f6b0dd 100755 --- a/scripts/setup-dns-proxy.sh +++ b/scripts/setup-dns-proxy.sh @@ -158,7 +158,22 @@ kctl exec -n openshell "$POD" -- \ sh -c "nohup python3 -u /tmp/dns-proxy.py '${DNS_UPSTREAM}' '${VETH_GW}' \ > /tmp/dns-proxy.log 2>&1 &" -sleep 2 +# Wait for forwarder to actually be serving (up to 10s). +# The PID file is written before the socket is bound, so we probe +# with a real DNS query instead of just checking the file. See #2017. +_dns_ready=0 +for _i in $(seq 1 10); do + if kctl exec -n openshell "$POD" -- \ + sh -c "echo -ne '\x00\x1e\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x06google\x03com\x00\x00\x01\x00\x01' \ + | timeout 1 socat - UDP:${VETH_GW}:53 2>/dev/null" | grep -q .; then + _dns_ready=1 + break + fi + sleep 1 +done +if [ "$_dns_ready" -eq 0 ]; then + echo "WARNING: DNS forwarder not responding after 10s — verification may fail" +fi # ── Step 4: Allow UDP DNS in sandbox iptables ─────────────────────── # @@ -272,12 +287,19 @@ if [ -n "$SANDBOX_NS" ]; then fi # 6d. Actual DNS resolution from sandbox (getent hosts) - DNS_RESULT="$(sb_exec getent hosts github.com 2>/dev/null || true)" + # Retry up to 3 times — on slower hardware (Jetson ARM64) the forwarder + # may need a few extra seconds after binding. See #2017. + DNS_RESULT="" + for _dns_try in 1 2 3; do + DNS_RESULT="$(sb_exec getent hosts github.com 2>/dev/null || true)" + [ -n "$DNS_RESULT" ] && break + [ "$_dns_try" -lt 3 ] && sleep 2 + done if [ -n "$DNS_RESULT" ]; then echo " [PASS] getent hosts github.com -> ${DNS_RESULT}" VERIFY_PASS=$((VERIFY_PASS + 1)) else - echo " [FAIL] getent hosts github.com returned empty (DNS not resolving)" + echo " [FAIL] getent hosts github.com returned empty after 3 attempts (DNS not resolving)" VERIFY_FAIL=$((VERIFY_FAIL + 1)) fi else From e54f9957f6470855cbb3702db5c1f0704c5ec99b Mon Sep 17 00:00:00 2001 From: Aaron Erickson Date: Fri, 17 Apr 2026 13:54:33 -0700 Subject: [PATCH 2/2] fix(dns): use printf instead of echo -ne for POSIX portability Address CodeRabbit review: echo -ne with \x hex escapes is not reliable across all /bin/sh implementations. printf '%b' is POSIX-portable and produces the same raw bytes. Co-Authored-By: Claude Opus 4.6 (1M context) --- scripts/setup-dns-proxy.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/setup-dns-proxy.sh b/scripts/setup-dns-proxy.sh index 40af4f6b0dd..5ae751f4a4e 100755 --- a/scripts/setup-dns-proxy.sh +++ b/scripts/setup-dns-proxy.sh @@ -164,7 +164,7 @@ kctl exec -n openshell "$POD" -- \ _dns_ready=0 for _i in $(seq 1 10); do if kctl exec -n openshell "$POD" -- \ - sh -c "echo -ne '\x00\x1e\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x06google\x03com\x00\x00\x01\x00\x01' \ + sh -c "printf '%b' '\x00\x1e\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x06google\x03com\x00\x00\x01\x00\x01' \ | timeout 1 socat - UDP:${VETH_GW}:53 2>/dev/null" | grep -q .; then _dns_ready=1 break