jschoubben
1ce1c3d4e0
A container runtime on the same workstation sets the kernel's forwarding policy to drop, and the virtualisation daemon's own accept rules do not override it — both are consulted and a drop anywhere is the answer. The machines then get addresses and resolve names, because the daemon's resolver is on the bridge, and discard every packet to anything real. The sharpest 'available is not adequate' yet: nothing is misconfigured, nothing logs, and it presents as every image pull hanging. A workstation that runs containers is the ordinary case, so it is a prerequisite — verified by reaching something, never by reading a setting. Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF
03-DESIGN / 01-to-be
The mesh being built toward. Every statement here traces to a record in
02-DECISIONS/; nothing arrives by drafting.
A document here describes an intention. What currently runs is in
00-as-is/, and the two are never merged — when something ships, the as-is
document is written and this one's status becomes implemented.
| Document | Covers | Rests on |
|---|---|---|
00-work-breakdown.md |
How the decomposition gets built, in what order, and where a human must look | ADR 0015 |
01-end-to-end-testing.md |
The lab: a real mesh a change can be run against before it reaches nodes | ADR 0016, 0029 |
02-scenario-declaration.md |
What a scenario declares — the underlay, and what to place on it | ADR 0031 |
03-scenario-lifecycle.md |
What happens to a scenario — raise, snapshot, restore, move, destroy | ADR 0032 |
04-lab-installation.md |
Getting the lab onto a clean machine, and why it verifies capability rather than installation | ADR 0008 |
05-the-node-host.md |
Tier 0 — the one thing installed by hand, and the only thing that changes a machine | ADR 0037 |
Not yet written
- The eight bounded contexts. ADR 0015 decides the decomposition; the per-context specifications do not exist yet. The work breakdown says in what order they are needed.
- Domain grouping outside the core. ADR 0017 settles the principle and explicitly does not settle the domain list. That is a research effort, not a design document, until it concludes.