From 363039f337ad1684865f989391a65ff067547e64 Mon Sep 17 00:00:00 2001 From: jochen Date: Wed, 28 Oct 2026 15:01:42 +0100 Subject: [PATCH] mesh-build-image README: a node without tun is healthy and not eligible, as the module now says (issue 1126) --- modules/mesh-build-image/README.md | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/modules/mesh-build-image/README.md b/modules/mesh-build-image/README.md index 82b29c38..86ebe743 100644 --- a/modules/mesh-build-image/README.md +++ b/modules/mesh-build-image/README.md @@ -16,12 +16,14 @@ credential and an environment built from scratch. The account's subordinate user and group ranges are not declared anywhere: the node-engine makes every `user` account with `useradd`, which allocates them. The module's health reads `/etc/subuid` and `/etc/subgid` and is unhealthy -without a range for the account, without buildah, when a user namespace cannot be made, or when `/dev/net/tun` -cannot be opened (buildah makes a RUN line's network with pasta, which needs the tun driver; on 2026-10-28 a build node had the -device node and no driver, so every image build there failed with "Failed to open() /dev/net/tun: No such device"). The -kernel module loads `tun` at boot. Whatever the health refuses, the node is **not eligible**: the seat's puller judges -by a capacity of 0 with that reason (`capacity.`, which `build_usage` shows), so the asks go to a node that can -build them; a look that passes again wakes the puller. +when the module cannot run: without a range for the account, without buildah, when a user namespace cannot be made, +or when the disk is under its floor. A node where `/dev/net/tun` cannot be opened stays **healthy** and is **not +eligible** (buildah makes a RUN line's network with pasta, which needs the tun driver; on 2026-10-28 a build node had +the device node and no driver, so every image build there failed with "Failed to open() /dev/net/tun: No such +device"): the seat's puller judges by a capacity of 0 with that reason (`capacity.`, which `build_usage` shows), +so the asks go to a node that can build them, and its health says "not eligible" with the cause, so a node that +cannot build here now never holds the module's delivery for every node. The kernel module loads `tun` at boot; a look +that passes again wakes the puller. The Dockerfile's steps may use the network (ADR 0487 ยง6); nothing a step can read holds a key.