From 0b0729562b1d10df27a5c42625acc94358fd938e Mon Sep 17 00:00:00 2001 From: didericis Date: Tue, 21 Jul 2026 20:46:47 -0400 Subject: [PATCH] fix(macos): stop podman re-injecting the gateway name into containers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The address-bearing proxy URLs from 892bfc16 were written correctly but never took effect: podman copies the host's proxy environment into every container by default, and that copy overrides containers.conf `env`, restoring the `bot-bottle-gateway` name a nested container cannot resolve. Verified on the macOS host — containers still reported `wget: bad address 'bot-bottle-gateway:9099'` with the addresses in place. Setting http_proxy=false disables only podman's own passthrough; the proxy vars still reach containers, by address, from the env list. Co-Authored-By: Claude Opus 4.8 --- .../backend/macos_container/nested-containers-init.sh | 4 ++++ tests/unit/test_macos_nested_containers.py | 7 +++++++ 2 files changed, 11 insertions(+) diff --git a/bot_bottle/backend/macos_container/nested-containers-init.sh b/bot_bottle/backend/macos_container/nested-containers-init.sh index e4a4637..0a18a01 100755 --- a/bot_bottle/backend/macos_container/nested-containers-init.sh +++ b/bot_bottle/backend/macos_container/nested-containers-init.sh @@ -136,6 +136,10 @@ path = Path(os.environ["CONTAINERS_CONF"]) path.write_text("\n".join([ "[containers]", 'cgroups="disabled"', + # podman copies the host's proxy vars into every container by default, + # and that copy *wins* over the env below — putting the unresolvable + # gateway name back. Turn it off so the address-bearing URLs stand. + "http_proxy=false", 'hosts_file="/etc/hosts"', f'volumes=["{ca}:{ca}:ro"]', "env=[", diff --git a/tests/unit/test_macos_nested_containers.py b/tests/unit/test_macos_nested_containers.py index 0b2781b..1391eb2 100644 --- a/tests/unit/test_macos_nested_containers.py +++ b/tests/unit/test_macos_nested_containers.py @@ -174,6 +174,13 @@ class TestInitScript(unittest.TestCase): self.assertIn('$2 == name { print $1; exit }', self.script) self.assertIn('value.replace(name, ip)', self.script) + def test_disables_podmans_own_proxy_passthrough(self) -> None: + """podman copies the host's proxy vars into every container by + default, and that copy overrides the env we set — putting the + unresolvable gateway name back and leaving nested containers at + "bad address 'bot-bottle-gateway'".""" + self.assertIn('"http_proxy=false"', self.script) + def test_keeps_the_gateway_name_in_no_proxy(self) -> None: """NO_PROXY is matched against what a client asks for, and code inside a nested container still says bot-bottle-gateway."""