[v18] vnet linux support by tangyatsu · Pull Request #64736 · gravitational/teleport

tangyatsu · 2026-03-17T18:07:30Z

changelog: Added Linux support for VNet

Manual Test Plan

Test Environment

it relies on the presence of systemd, D-Bus and polkit, most modern desktop Linux distros include them.

To make it work, you need to install the required polkit and D-Bus configuration files.

Polkit action:

sudo tee /usr/share/polkit-1/actions/org.teleport.vnet1.policy > /dev/null <<'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
  "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
  "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
<policyconfig>

  <action id="org.teleport.vnet1.manage-daemon">
    <description>Start Teleport VNet</description>
    <message>Authentication is required to start Teleport VNet</message>
    <defaults>
      <allow_any>no</allow_any>
      <allow_inactive>no</allow_inactive>
      <!-- Default behavior if no rule matches -->
      <allow_active>yes</allow_active>
    </defaults>
  </action>

</policyconfig>
EOF

D‑Bus config
By default, d-bus will not allow any user (including root) to own the org.teleport.vnet1 name:

sudo tee /usr/share/dbus-1/system.d/org.teleport.vnet1.conf > /dev/null <<'EOF'
<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-Bus Bus Configuration 1.0//EN"
 "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
<busconfig>
  <policy user="root">
    <allow own="org.teleport.vnet1"/>
  </policy>

  <policy context="default">
    <allow send_destination="org.teleport.vnet1"/>
  </policy>
</busconfig>
EOF

D‑Bus service file (activates systemd unit)

sudo tee /usr/share/dbus-1/system-services/org.teleport.vnet1.service > /dev/null <<'EOF'
[D-BUS Service]
Name=org.teleport.vnet1
SystemdService=teleport-vnet.service
User=root
Exec=/bin/false
EOF

Systemd unit

sudo tee /usr/lib/systemd/system/teleport-vnet.service > /dev/null <<'EOF'
[Unit]
Description=Teleport VNet D-Bus service
After=dbus.service
Requires=dbus.service

[Service]
Type=dbus
BusName=org.teleport.vnet1
ExecStart=/usr/bin/tsh vnet-daemon --debug
User=root
Group=root
EOF

I tested this on a cluster with:

PostgreSQL as a TCP app
dummy NGINX server as an HTTP app

I also set google.com as a custom DNS zone for VNet and checked access to workspace.google.com with VNet turned on.

It is actually convenient to inspect DNS behavior with resolvectl.

resolvectl status shows all active links.
resolvectl domain shows domains attached to each link, for example:

Link 37 (TeleportVNet): ~internal.example.com ~google.com ~teleport.tangyatsu.com ~teleport.dev

You can query and verify which link handled DNS:

resolvectl query workspace.google.com --legend=yes

Example output:

workspace.google.com: 165.xxx.xxx.xxx  -- link: TeleportVNet

Test Cases

can start VNet with tsh vnet
can connect to TCP app over VNet
can connect to SSH node over VNet
HTTP app access continues to work with VNet on and off
public URIs under a custom DNS zone are still reachable (with VNet on and off)
can view daemon logs with journalctl -u teleport-vnet.service
can start and stop VNet from Connect
can start VNet with sudo tsh vnet without presence of config files

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3e1f7fb7af

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-03-17T21:54:41Z

+	if slices.Contains(services, vnetDBusServiceName) {
+		return nil


Treat activatable D-Bus names as unavailable until usable

This check returns success as soon as org.teleport.vnet1 appears in ListActivatableNames, but execAdminProcess only falls back to the root child-process path when this function returns an error. In partial/misconfigured installs (activatable name present but unit or executable broken), runService then fails at Start and sudo tsh vnet exits instead of using the intended fallback path.

Useful? React with 👍 / 👎.

It's probably a good idea to consider fixing the Codex comments on master and backporting if they indeed point out real issues.

Sometimes it behaves like the worst reviewer ever where it doesn't point out all potential problems all at once, like in this PR #64769.

chatgpt-codex-connector · 2026-03-17T21:54:41Z

+		if addr.IsUnspecified() || addr.IsLoopback() {
+			continue


Preserve loopback upstream DNS servers when loading Linux DNS

Filtering out all loopback DNS entries means systems that intentionally use a local resolver (for example dnsmasq/unbound on 127.0.0.1 or ::1) can end up with no upstream resolvers at all. In that case unmatched lookups hit dns.Server.forward with an empty upstream list and fail, breaking non-Teleport DNS while VNet is enabled.

Useful? React with 👍 / 👎.

ravicious

I built Connect using code from tangyatsu/vnet-linux-v18 and tangyatsu/vnet-linux-systemd-dbus-polkit-files-v18. I did some light testing and it seems to work.

…#64493) * replace TCP socket with unix socket for VNet user-admin IPC for Linux * review improvements and fixes

public-teleport-github-review-bot · 2026-04-01T17:35:00Z

@tangyatsu - this PR will require admin approval to merge due to its size. Consider breaking it up into a series smaller changes.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3113071b8f

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-04-01T17:57:42Z

+		case <-ticker.C:
+			state, err := getSystemdUnitState(ctx, conn, vnetSystemdUnitName)
+			if err != nil {
+				return trace.Wrap(err, "querying systemd service %s", vnetSystemdUnitName)


Prioritize shutdown path when context is canceled

When ctx is canceled, this loop can still take the ticker.C branch if a tick is ready at the same time, and then getSystemdUnitState(ctx, ...) returns a canceled-context error. That exits runService before calling stopService, so tsh vnet can terminate while teleport-vnet.service is left running. This is most visible on normal shutdowns that race with the 1s poll tick.

Useful? React with 👍 / 👎.

tangyatsu · 2026-04-01T18:47:18Z

Cherry-picked the commit that replaces TCP socket with Unix socket and went through the test cases again

…linux-v18 # Conflicts: # go.mod

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9074652cbf

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-04-17T11:21:43Z

+	conn, err := systemddbus.NewWithContext(ctx)
+	if err != nil {
+		return trace.NotFound("systemd D-Bus is unavailable: %v", err)
+	}


Stop service when post-start systemd attach fails

runService starts teleport-vnet.service before opening the systemd D-Bus monitoring connection, but if systemddbus.NewWithContext fails here it returns immediately and never calls stopService. In that failure path, tsh vnet exits with an error while the privileged service can continue running in the background, which is especially problematic for transient D-Bus/systemd access issues.

Useful? React with 👍 / 👎.

nklaassen and others added 26 commits March 17, 2026 17:25

first build

76aa49a

add d-bus daemon for vnet

ee2eec0

set up dns server via systemd-resolved d-bus api

a4716d0

get DNS upstreams via systemd-resolved API

079f75b

never forward DNS requests to self

99b3494

refactor: move all systemd-resolved logic to a separate package

e07e87c

refactor: move all polkit logic to a separate package

f77a93d

filter systemd-resolved loopback upstreams

63f3b06

add scope for link-local IPv6 adresses for upstreams

ca2ab53

comment updates, small fixes, and typo cleanup

3633e70

return uid from D-Bus authorize func

5edefdd

add typed constants for systemd unit states

7733d30

avoid using canceled context for stopping VNet daemon

32c3268

refactor: do not store ctx in dbusDaemon

a6e3a2a

Improve dbusDaemon lifecycle handling

5d3f9ba

Log errors from dbusDaemon.Wait

61d39af

refactor: reuse shared darwin/linux code for admin process

a9af730

reintroduce isDiagSupported

8c8ba11

refactor logging errors from dbusDaemon.Wait

bf2465e

do not return error for missing TUN during deconfigure

27c0c4b

use d.conn.Context()

1f8bad4

avoid using bare slog logger

81cc965

avoid mutating cached upstream nameserver slices

71d10af

fix race between dbus Start and Stop

b6ac1b6

small fixes

05fef4f

some refactoring

2255d4f

tangyatsu requested review from nklaassen and ravicious March 17, 2026 18:07

fix go mod tidy

3e1f7fb

tangyatsu marked this pull request as ready for review March 17, 2026 21:45

tangyatsu requested review from r0mant, rosstimothy, russjones and zmb3 as code owners March 17, 2026 21:45

github-actions bot added backport size/lg tsh tsh - Teleport's command line tool for logging into nodes running Teleport. ui labels Mar 17, 2026

chatgpt-codex-connector bot reviewed Mar 17, 2026

View reviewed changes

ravicious approved these changes Mar 19, 2026

View reviewed changes

zmb3 approved these changes Mar 19, 2026

View reviewed changes

public-teleport-github-review-bot bot removed the request for review from nklaassen March 19, 2026 22:42

nklaassen approved these changes Mar 20, 2026

View reviewed changes

Replace TCP socket with unix socket for VNet user-admin IPC for Linux (…

edef658

…#64493) * replace TCP socket with unix socket for VNet user-admin IPC for Linux * review improvements and fixes

tangyatsu force-pushed the tangyatsu/vnet-linux-v18 branch from c48c961 to 3113071 Compare April 1, 2026 17:51

chatgpt-codex-connector bot reviewed Apr 1, 2026

View reviewed changes

Merge remote-tracking branch 'origin/branch/v18' into tangyatsu/vnet-…

9074652

…linux-v18 # Conflicts: # go.mod

tangyatsu force-pushed the tangyatsu/vnet-linux-v18 branch from 3113071 to 9074652 Compare April 17, 2026 11:10

chatgpt-codex-connector bot reviewed Apr 17, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[v18] vnet linux support#64736

[v18] vnet linux support#64736
tangyatsu wants to merge 29 commits intobranch/v18from
tangyatsu/vnet-linux-v18

tangyatsu commented Mar 17, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

chatgpt-codex-connector bot Mar 17, 2026

Uh oh!

ravicious Mar 20, 2026

Uh oh!

chatgpt-codex-connector bot Mar 17, 2026

Uh oh!

ravicious left a comment

Uh oh!

public-teleport-github-review-bot bot commented Apr 1, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

chatgpt-codex-connector bot Apr 1, 2026

Uh oh!

tangyatsu commented Apr 1, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

chatgpt-codex-connector bot Apr 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		if slices.Contains(services, vnetDBusServiceName) {
		return nil

Conversation

tangyatsu commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Manual Test Plan

Test Environment

Test Cases

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

ravicious Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector bot Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

ravicious left a comment

Choose a reason for hiding this comment

Uh oh!

public-teleport-github-review-bot bot commented Apr 1, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

tangyatsu commented Apr 1, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

tangyatsu commented Mar 17, 2026 •

edited

Loading