Restart dnsmasq after a render, since a reload never applied one #29

2026-10-10T21:34:00-07:00

dejima-agent commented

2026-10-10 21:34:00 -07:00

Summary generated by LLM agent

render applied a changed allowlist with systemctl reload dnsmasq, which sends a SIGHUP. dnsmasq does not re-read its config files on a SIGHUP (see man dnsmasq, SIGNALS). As a result, a name added to a .dejima/allowed-domains was written to /etc/dnsmasq.d/ci-allow.conf but never loaded, and jobs could not resolve it until dnsmasq restarted for some other reason. show and check both report on the file, so both said everything was up to date.

Seen on a runner: songtrace's newly declared pypi.org, files.pythonhosted.org and the two PyTorch hosts failed DNS in CI even though show listed all of them. Names that were in the file when dnsmasq last started resolved fine. A manual systemctl restart dnsmasq fixed it.

Changes:

The default reload in the tool, etc/config.example and install.sh is now systemctl restart dnsmasq.
install.sh no longer offers the old systemctl reload dnsmasq back as the default when it finds it in an existing config.
VERSION 4 and upgrades/0004-restart-dnsmasq.md. Existing hosts need the config change plus one manual restart. render only runs the command when the file changes, and on those hosts the file is already current, so changing the config alone does nothing until the next allowlist change.
The comments that described the reload as a SIGHUP are updated. The flush-then-restart ordering still holds, because a restart also empties the cache.

Tested: bats test/ passes, 222 tests.

**Summary generated by LLM agent** `render` applied a changed allowlist with `systemctl reload dnsmasq`, which sends a SIGHUP. dnsmasq does not re-read its config files on a SIGHUP (see `man dnsmasq`, SIGNALS). As a result, a name added to a `.dejima/allowed-domains` was written to `/etc/dnsmasq.d/ci-allow.conf` but never loaded, and jobs could not resolve it until dnsmasq restarted for some other reason. `show` and `check` both report on the file, so both said everything was up to date. Seen on a runner: songtrace's newly declared `pypi.org`, `files.pythonhosted.org` and the two PyTorch hosts failed DNS in CI even though `show` listed all of them. Names that were in the file when dnsmasq last started resolved fine. A manual `systemctl restart dnsmasq` fixed it. Changes: - The default `reload` in the tool, `etc/config.example` and `install.sh` is now `systemctl restart dnsmasq`. - `install.sh` no longer offers the old `systemctl reload dnsmasq` back as the default when it finds it in an existing config. - `VERSION` 4 and `upgrades/0004-restart-dnsmasq.md`. Existing hosts need the config change plus one manual restart. `render` only runs the command when the file changes, and on those hosts the file is already current, so changing the config alone does nothing until the next allowlist change. - The comments that described the reload as a SIGHUP are updated. The flush-then-restart ordering still holds, because a restart also empties the cache. Tested: `bats test/` passes, 222 tests.

dejima-agent added 1 commit 2026-10-10 21:34:00 -07:00

Restart dnsmasq after a render, since a reload never applied one

tests / runner-env (confined) (pull_request_target) Successful in 59s

Details

tests / tests (pull_request_target) Successful in 2m4s

Details

tests / compose-schema (pull_request_target) Successful in 1m10s

Details

tests / runner-env (privileged) (pull_request_target) Successful in 1m3s

Details

b115fb977a

The default reload command was systemctl reload dnsmasq, which is a SIGHUP.
dnsmasq does not re-read its config files on one, so a name added to a
declaration was installed and never loaded: jobs could not resolve it until
dnsmasq restarted for some other reason, while show and check both reported the
file as current.

The installer no longer offers the old value back, and a v4 note covers hosts
that have it, including the one restart render cannot do for them: it only
runs the command when the file changes, and on those hosts it already has.

branderson approved these changes 2026-10-10 21:49:18 -07:00

branderson merged commit 26ec9f8b1e into main

2026-10-10 21:49:23 -07:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dejima/dejima-ci-hardener#29