Archived
jschoubben
2b20a12c4a
A port declared from the mesh admitted the machines' own addresses on the private network. A container reaching a port on the machine it runs on comes from a bridge, matching none of them — and where the container runtime routes directly, that packet is delivered to this machine rather than forwarded, so the forward chain's allowance never saw it either. ADR 0100 requires this to work: the store is reachable 'from a container on the node itself'. It was, through a rule the predecessor left, which allowed the private ranges wholesale. Converging the machine replaced that with the four overlay addresses and closed it. Measured, and it was an outage: every module reaching another by its machine's own name timed out for eleven hours while the mesh reported the machine healthy. A web application logged 'connection to server at novox.internal (10.10.0.1), port 6852 failed: timeout expired' throughout. Asked for by the link it arrives on, for the reason the forward chain no longer names an address: a range describes one machine and goes stale in silence. A port open to everything needs no such line.