refactor(smolmachines): inline sidecar proxy host
lint / lint (push) Successful in 2m1s
test / unit (pull_request) Successful in 57s
test / integration (pull_request) Successful in 18s
test / coverage (pull_request) Successful in 1m10s

This commit is contained in:
2026-07-09 17:42:04 +00:00
committed by didericis
parent 9f0d56b75d
commit bfd3e659e8
2 changed files with 8 additions and 24 deletions
+8 -15
View File
@@ -92,7 +92,7 @@ def launch(
try:
loopback_ip, network = _allocate_resources(plan, stack)
plan = _mint_certs(plan)
proxy_host = _proxy_host(plan, loopback_ip)
proxy_host = loopback_ip
plan = _start_bundle(plan, network, proxy_host, stack)
agent_from_path = _agent_from_path(plan)
@@ -287,14 +287,13 @@ def _launch_vm(
) -> None:
"""Create, patch, and start the smolvm VM; register teardown.
--allow-cidr is `proxy_host/32` — the per-bottle loopback alias
on macOS or the bridge gateway on Linux (see `_proxy_host`). This
ensures the guest can only reach bundle ports published on that IP,
not the container IP directly. force_allowlist confirms the
allowlist persisted (patching smolvm 0.8.0's silent-drop of
--allow-cidr when combined with --from) and fails closed if it
can't. Smolfile isn't usable here — smolvm 0.8.0 makes --from
and --smolfile mutually exclusive."""
--allow-cidr is `proxy_host/32` — the per-bottle loopback alias.
This ensures the guest can only reach sidecar forwarders published
on that IP, not host localhost or another bottle's alias.
force_allowlist confirms the allowlist persisted (patching smolvm
0.8.0's silent-drop of --allow-cidr when combined with --from) and
fails closed if it can't. Smolfile isn't usable here — smolvm 0.8.0
makes --from and --smolfile mutually exclusive."""
tsi_cidr = f"{proxy_host}/32"
_smolvm.machine_create(
plan.machine_name,
@@ -341,12 +340,6 @@ def _init_vm(plan: SmolmachinesBottlePlan) -> None:
_smolvm.wait_exec_ready(plan.machine_name)
def _proxy_host(plan: SmolmachinesBottlePlan, loopback_ip: str) -> str:
"""Return the per-bottle host address used for TSI and forwarders."""
del plan
return loopback_ip
def _label_for_port(port: int) -> str:
if port == _EGRESS_PORT:
return "egress"