[P2] CreateTap not idempotent: retry attempts mask the root-cause create error #20

New issue

Closed

opened 2026-07-03 14:04:50 +00:00 by a73x · 1 comment

a73x commented

2026-07-03 14:04:50 +00:00

(Migrated from git.a73x.sh)

[claude 2026-07-03] Found running eitri in the sandbox. Repro: create a VM with disk_gb=1 (below base image size). Attempt 1 creates the tap, then PrepareDisk correctly rejects the shrink. Attempt 2 re-runs CreateTap on the now-existing UP tap: 'ip tuntap add' fails with 'ioctl(TUNSETIFF): Device or resource busy' (verified in-sandbox), which is NOT in netenv's tolerated() list ('File exists'/'already exists'). Result: the VM terminal-fails with last_error='ip tuntap add ... exit status 1' — masking the real cause ('disk_gb 1 ... smaller than base image'). netenv.EnsureBridge's own comment says string allow-lists are fragile and to use existence checks instead; CreateTap should do the same: skip 'ip tuntap add' when 'ip link show dev ' succeeds (master/up steps are already idempotent).

Migrated from git-collab issue 94303e6508dbf2d41ace315385e9f5bff48e1041.

Original author: a73x dev@a73x.sh.

Close reason: Fixed by patch 64df1ea2

[claude 2026-07-03] Found running eitri in the sandbox. Repro: create a VM with disk_gb=1 (below base image size). Attempt 1 creates the tap, then PrepareDisk correctly rejects the shrink. Attempt 2 re-runs CreateTap on the now-existing UP tap: 'ip tuntap add' fails with 'ioctl(TUNSETIFF): Device or resource busy' (verified in-sandbox), which is NOT in netenv's tolerated() list ('File exists'/'already exists'). Result: the VM terminal-fails with last_error='ip tuntap add ... exit status 1' — masking the real cause ('disk_gb 1 ... smaller than base image'). netenv.EnsureBridge's own comment says string allow-lists are fragile and to use existence checks instead; CreateTap should do the same: skip 'ip tuntap add' when 'ip link show dev <tap>' succeeds (master/up steps are already idempotent). --- Migrated from git-collab issue `94303e6508dbf2d41ace315385e9f5bff48e1041`. Original author: a73x <dev@a73x.sh>. Close reason: Fixed by patch 64df1ea2

a73x commented

2026-07-03 14:15:15 +00:00

(Migrated from git.a73x.sh)

[claude 2026-07-03] Fix verified end-to-end in a rebuilt sandbox: disk_gb=1 VM now terminal-fails with last_error 'disk_gb 1 (1073741824 bytes) is smaller than base image ...' instead of the tap artifact. Additional sandbox probes, all clean: full lifecycle create->ready->ICMP->reap (SMOKE PASS); negative disk_gb -> 400; enroll rate limit 5x403 -> 429; reap removes taps incl. the failed VM's orphan; credential revoke -> 204, live session killed within one report tick, host offline at the 30s window expiry, sustained offline with the agent alive in its 60s auth backoff (not crashlooping). Patch 64df1ea2 in review.