Repository navigation
ateomnet: replace stale named namespaces - #1682
Merged
Eitan Yarmush (EItanya) merged 1 commit intoSep 17, 2026
Merged
Eitan Yarmush (EItanya) merged 1 commit into
Eitan Yarmush (EItanya) merged 1 commit into
Conversation
Collaborator
Author
Merged
Eitan Yarmush (EItanya)
left a comment
Eitan Yarmush (EItanya)
left a comment
Collaborator
There was a problem hiding this comment.
🤖 AI-generated review.
No correctness issues found in 06089cb5. Two optional improvements:
-
Clarify namespace ownership — net.go:387–393 describes per-actor activation, but both current callers create the namespace at worker startup using the pod UID. Document that lifecycle and the caller’s responsibility to own the name exclusively.
-
Test retained handles — net_linux_test.go:482–486 closes the original handle before replacement. Keeping it open and verifying it remains usable would cover the PR’s stated guarantee.
All eight package tests passed locally under root. An additional probe confirmed retained handles remain usable, the replacement is distinct, and the caller’s namespace is restored. CI is green; cluster E2E was not rerun locally.
Remove mounted and unmounted leftovers before namespace creation. Reject invalid names and avoid following symlinks during unmount. Existing namespace handles remain valid.
Benjamin Elder (BenTheElder)
force-pushed
the
ateomnet-stale-netns
branch
from
September 17, 2026 00:31
06089cb to
291f48f
Compare
Collaborator
Author
|
Good points, updated. |
Eitan Yarmush (EItanya)
approved these changes
Sep 17, 2026
Eitan Yarmush (EItanya)
merged commit Sep 17, 2026
0ea56b6
into
agent-substrate:main
11 checks passed
Eitan Yarmush (EItanya)
pushed a commit
to kagent-dev/substrate
that referenced
this pull request
Sep 23, 2026
This is part of agent-substrate#1266 , opening now for discussion. Stacked on agent-substrate#1682 which was slightly orthogonal. This is loosely based on the mini proposal by @howardjohn as discussed in the community meeting, and feedback from @bowei @EItanya @LiorLieberman @aojea. https://docs.google.com/document/d/1TycfQ3iiEpbI3rveMIj0S2PpPuLecb8I5R--yTpt9Ig/edit?resourcekey=0-kJbtEZ-KGzuL5eCjHDvBhg&tab=t.0#heading=h.ga9bfaf55ptk Roughly: 1. Actor sandboxes each get their own netns. - gVisor grabs all interfaces in the netns, and tap currently requires running something like slipr, so for now we do two netns + a veth when gVisor. 3. In the netns we directly intercept TCP => atunnel for general traffic. 4. In the netns we serve a trivial TCP+UDP DNS relay to the pod resolution. - In the future we can insert policy here. 6. We consistently inject a modified resolv.conf instead of bind-mounting it (gVisor) across both runtimes. 7. Readiness probe dialing happens in the actor netns. Every actor gets the same fixed guest IP as before, which is only visible to the actor. All inbound/outbound traffic comes from atunnel / the DNS relay. The actor no longer has any direct use of the pod interface, so we can begin to consider ateom using the network itself. When we add the rest of multi-actor changes, this greatly simplifies thing. Full multi-actor requires further changes, but this diff is already large (suggest reading commit by commit) and can stand-alone. I'll file more stacked changes when we've got consensus on this one.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Remove mounted and unmounted leftovers before namespace creation. Reject invalid names and avoid following symlinks during unmount. Existing namespace handles remain valid.
Tiny pre-req for #1266
Also considering anonymous namespaces or per-activation IDs but eh we can revisit that later.