fix(onboard): reject macOS Podman compat socket before gateway launch (#7320) - #7350
Closed
yimoj wants to merge 3 commits into
Closed
fix(onboard): reject macOS Podman compat socket before gateway launch (#7320)#7350yimoj wants to merge 3 commits into
yimoj wants to merge 3 commits into
Conversation
…NVIDIA#7320) Apple Silicon macOS forces the OpenShell Docker-driver gateway path. When the Docker CLI is routed to a Podman machine's docker-compat socket, Podman's /info mimics Docker (no 'podman' marker: ServerVersion '5.6.2', OperatingSystem 'fedora'), so preflight misclassified the runtime as 'docker', skipped the unsupported-runtime gate, and let onboarding force the Docker-driver gateway, which then binds Podman's VM-only bridge IP (10.89.1.1) and exits EADDRNOTAVAIL. Harden assessHost() to reclassify a Docker CLI fronting Podman's compatibility socket as 'podman' using observed docker-compat signals: the explicit 'docker version' 'Podman Engine' component (primary) and the /info ProductLicense 'Apache-2.0' (backstop). This makes the existing preflight rejection fire before any gateway launch. Podman stays unsupported per ci/platform-matrix.json; the recovery message now names Docker Engine, Docker Desktop, and Colima. Signed-off-by: Yimo Jiang <yimoj@nvidia.com>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughOnboarding preflight detects Podman routed through Docker-compatible sockets, classifies it as unsupported, verifies rejection behavior, and expands remediation guidance to include Docker Desktop and Colima. ChangesPodman preflight handling
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant Onboarding
participant assessHost
participant DockerCLI
participant Preflight
Onboarding->>assessHost: assess host runtime
assessHost->>DockerCLI: query docker info and docker version
DockerCLI-->>assessHost: Docker-compatible Podman output
assessHost-->>Preflight: runtime = podman, unsupported = true
Preflight-->>Onboarding: exit with code 1 and remediation guidance
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
…VIDIA#7320) The codebase-growth-guardrails check forbids adding if statements to changed test files. Replace the platform guard with it.runIf(isLinuxDockerDriverGateway Enabled()) so the test body stays linear. Signed-off-by: Yimo Jiang <yimoj@nvidia.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/lib/onboard/fatal-runtime-preflight.test.ts`:
- Around line 33-44: Update the test declaration for “exits when Podman is
detected on a Docker-driver gateway platform” to use
it.skipIf(!isLinuxDockerDriverGatewayEnabled()) instead of the in-body
early-return guard. Preserve the existing test assertions and behavior when the
platform condition is enabled.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: f82b1cbf-9db6-4028-82c3-cca5c3eba7fd
📒 Files selected for processing (5)
src/lib/onboard/fatal-runtime-preflight.test.tssrc/lib/onboard/preflight-messages.test.tssrc/lib/onboard/preflight-messages.tssrc/lib/onboard/preflight-podman-compat.test.tssrc/lib/onboard/preflight.ts
Contributor
PR Review Advisor — InformationalAdvisor assessment: Informational / high confidence Model lanes
Nemotron output stays in workflow artifacts and does not change the assessment above. E2E guidanceAdvisory only. E2E / PR Gate selects and runs jobs independently. Recommended E2E: 1 optional E2E recommendation
This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge. |
…DIA#7320) Align with CodeRabbit's requested API: it.skipIf(!isLinuxDockerDriverGateway Enabled()) is equivalent to the prior it.runIf and keeps the test body linear for the codebase-growth-guardrails check. Signed-off-by: Yimo Jiang <yimoj@nvidia.com>
Collaborator
Author
|
Superseded by #7353, opened from an in-repo branch so the credential-bearing onboarding E2E gate (onboard-repair, onboard-resume) runs under the trusted workflow instead of being skipped for a fork head. Same commits and |
9 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
On Apple Silicon macOS, onboarding forces the OpenShell Docker-driver gateway path. When the Docker CLI is routed to a Podman machine's Docker compatibility socket, preflight failed to recognize Podman and let onboarding start the Docker-driver gateway, which then bound Podman's VM-only bridge address (
10.89.1.1:8080) and exitedEADDRNOTAVAIL. This change detects Podman behind the compatibility socket in preflight and fails closed early with the existing unsupported-runtime guidance, before any gateway launch. Podman remains unsupported perci/platform-matrix.json; no Podman support is added.Related Issue
Fixes #7320
Changes
src/lib/onboard/preflight.ts:assessHost()now reclassifies a Docker CLI fronting Podman's docker-compat socket asruntime: "podman". Podman's/infomimics Docker and carries no"podman"marker (observed:ServerVersion "5.6.2",OperatingSystem "fedora"), so detection uses two observed docker-compat signals: the explicitdocker version --format '{{json .}}'"Podman Engine"server component (primary), and the/infoProductLicense: "Apache-2.0"(backstop when the version probe is unavailable). Thedocker versionprobe runs only when the daemon is reachable. No false positives on Docker Engine, Docker Desktop, or Colima.src/lib/onboard/preflight-messages.ts: the unsupported-runtime recovery message now names Docker Engine, Docker Desktop, and Colima (macOS reporters use Docker Desktop/Colima, not native Docker Engine).preflight-podman-compat.test.ts(real docker-compatinfo+versionmetadata drivesruntime: "podman"; real Docker stays supported) andfatal-runtime-preflight.test.ts(the rejection path); message-guidance assertions inpreflight-messages.test.ts.The existing preflight gate (
rejectUnsupportedContainerRuntime) already runs on both the fresh and resume paths before the gateway state; correcting runtime detection is what makes it fire. No new abstraction, config, or fallback path is introduced.Type of Change
Quality Gates
docs/reference/platform-support.mdxandtroubleshooting.mdxalready document Podman as unsupported and direct users to Docker Engine/Docker Desktop/Colima; this fix makes that already-documented rejection actually fire for the macOS docker-compat case.code-review(high) surfaced only two low-severity, non-blocking design notes (ProductLicense backstop scope; one extradocker versionsubprocess per reachable-DockerassessHost), both acceptable; awaiting maintainer sensitive-path review.Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run check:diffpassed when hooks were skipped or unavailablenpx vitest run src/lib/onboard/preflight-podman-compat.test.ts src/lib/onboard/fatal-runtime-preflight.test.ts src/lib/onboard/preflight-messages.test.ts src/lib/onboard/preflight.test.ts→ 143 passed; full--project cli→ 9593 passed / 1 skipped.Real-CLI E2E (Apple Silicon macOS, Podman docker-compat socket)
Reproduced the exact reporter command
./bin/nemoclaw.js onboard --freshon an Apple Silicon macOS host (macOS 26.5.2, arm64) with a runningpodman machinewhose Docker compatibility socket forwards to/var/run/docker.sock, Docker CLI 29.3.1 routed to it (ServerVersion 5.6.2,ProductLicense Apache-2.0,DefaultRuntime crun).✓ Container runtime: docker) and advanced to[2/8] Starting OpenShell gateway → Starting OpenShell Docker-driver gateway— the forced Docker-driver path the reporter hits.[1/8] Preflight checkswith✗ … Podman is not supported for this NemoClaw integration path. Switch to Docker Engine, Docker Desktop, or Colima, then rerun onboarding.and exits non-zero (1), before any gateway launch.assessHost()against the live socket now reportsruntime: "podman",isUnsupportedRuntime: true.Signed-off-by: Yimo Jiang yimoj@nvidia.com
Summary by CodeRabbit