Issue 110: on a converged node a container on the runtime's own network cannot reach the resolver #97

2026-09-23T23:13:41Z

jschoubben commented

2026-09-23 23:13:41 +00:00

Found reviewing the resolver's conversion, before it is assigned anywhere. The resolver declares it listens from the mesh, so a converged node's filter admits queries from private-network addresses. A container on a network its module declared asks via the runtime, from the machine itself — admitted. A container on the runtime's default network asks from its own address on that network — dropped. So at the flip, such a container has no DNS.

It is the same split that decided which container survived the hub's address change tonight: the forge is on the default network and lost its database, the service beside it is not and was untouched (issue 109). And it matters doubly because 109's stronger answer — give a container no address and make it always ask the resolver — is only available if every container can reach it.

Nothing fails while the node is adopted; the predecessor's firewall is still in force. Asks whether the resolver should be reachable from the runtime's own networks by the interface a packet arrives on (the exception the mesh's guard already makes), or whether every module should be required to declare a network — which would have prevented 109 too.

Found reviewing the resolver's conversion, before it is assigned anywhere. The resolver declares it listens *from the mesh*, so a converged node's filter admits queries from private-network addresses. A container on a network its module declared asks via the runtime, from the machine itself — admitted. A container on the runtime's **default** network asks from its own address on that network — dropped. So at the flip, such a container has no DNS. It is the same split that decided which container survived the hub's address change tonight: the forge is on the default network and lost its database, the service beside it is not and was untouched (issue 109). And it matters doubly because 109's stronger answer — give a container no address and make it always ask the resolver — is only available if every container can reach it. Nothing fails while the node is adopted; the predecessor's firewall is still in force. Asks whether the resolver should be reachable from the runtime's own networks by the interface a packet arrives on (the exception the mesh's guard already makes), or whether every module should be required to declare a network — which would have prevented 109 too.

jschoubben added 1 commit 2026-09-23 23:13:41 +00:00

Issue 110: on a converged node a container on the runtime's own network cannot reach the resolver 3a8515273d

Found reviewing the resolver's conversion. Nothing fails while the node is adopted; it
fails at the flip, and it is the same split that decided which container survived the
hub's address change.

jschoubben merged commit e7a90be3ee into main

2026-09-23 23:13:49 +00:00

jschoubben deleted branch issues/110-the-resolver-and-the-default-network

2026-09-23 23:13:49 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/hq#97