feat(probe): let the remote half run behind a real NAT - #35
Merged
Conversation
Everything the overlay exists for only matters between two hosts that cannot be
dialed. The rig had a public relay on one end, which is the easy case and hides
exactly the failure being chased — both ends found each other directly and the
discovery layer was never load-bearing.
--remote-bin wraps the remote invocation in anything, so the listener can run in
a container on the default bridge: outbound is masqueraded, inbound is not
forwarded, and the node advertises the host's address with a translated port.
That is a NAT rather than a simulated one, and it reproduces the reported
failure — runs now fail intermittently the way the field does.
--remote-bin "docker run --rm -v /usr/local/bin:/opt/probe:ro \
-v /etc/ssl/certs:/etc/ssl/certs:ro \
debian:bookworm-slim /opt/probe/mosh-probe"
The certificate mount is not optional: a slim image has no CA bundle, the
telemetry sink fails silently, and the remote half of every run goes unobserved
while looking identical to a node that had nothing to say.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
--remote-binso the remote end ofprobe-e2e.mjscan be wrapped in anything that ends up invoking the probe — notably a container on Docker's default bridge, which is a real NAT (MASQUERADE out, no inbound forwarding) rather than a simulated one.Everything the overlay exists for only matters between two hosts that cannot be dialed directly. A public relay on one end is the easy case and hides exactly the failure worth reproducing.
One file, 11 lines, default unchanged (
/usr/local/bin/mosh-probe) — existing invocations behave exactly as before.Note for whoever uses it:
debian:bookworm-slimships no CA bundle, so the telemetry sink fails silently and half the run goes unobserved. Mount/etc/ssl/certsinto the container.