Do not install a resolver on a host that will never run one #9

2026-08-06T02:26:13-07:00

dejima-agent commented

2026-08-06 02:26:13 -07:00

Summary generated by LLM agent

Making the runtime tier skip install.sh (#6) left install.sh's
dependencies installed on it anyway. ipset then sits unused, and dnsmasq
is worse than unused: the Debian package starts a resolver bound on port 53.
So the script installs a listener and then, forty lines later, disables
listeners — on the stated grounds that

Every listener is a way in, and a CI runner needs none of these.

Both packages belong to install.sh, which runs on one role. They are now
installed on that role only. iptables stays on both, because the host's own
egress policy uses it either way.

Earlier runs of this script did install dnsmasq on runtime hosts — the VM
this was found on is one — and an upgrade that leaves the old listener running
is not an upgrade. The runtime role therefore adds dnsmasq to the list of
services to disable. Disabled rather than purged, since anyone co-locating
both tiers on one machine still needs the package.

Testing

Both new lines were first written as [ "$ROLE" = ci ] && var=.... Under
set -euo pipefail an AND-list whose test is false exits 1 at the top level,
which aborts the script — so --role runtime would have died at the package
step, before installing anything. They are if blocks, and both branches were
exercised:

ci      -> pkgs=[ipset dnsmasq] unwanted=[avahi-daemon cups]
runtime -> pkgs=[]              unwanted=[avahi-daemon cups dnsmasq]

bash -n passes. Not yet run end-to-end on a machine; the next runtime
bootstrap is the first execution of the changed package step.

**Summary generated by LLM agent** Making the runtime tier skip `install.sh` (#6) left `install.sh`'s dependencies installed on it anyway. `ipset` then sits unused, and `dnsmasq` is worse than unused: the Debian package starts a resolver bound on port 53. So the script installs a listener and then, forty lines later, disables listeners — on the stated grounds that > Every listener is a way in, and a CI runner needs none of these. Both packages belong to `install.sh`, which runs on one role. They are now installed on that role only. `iptables` stays on both, because the host's own egress policy uses it either way. Earlier runs of this script *did* install `dnsmasq` on runtime hosts — the VM this was found on is one — and an upgrade that leaves the old listener running is not an upgrade. The runtime role therefore adds `dnsmasq` to the list of services to disable. Disabled rather than purged, since anyone co-locating both tiers on one machine still needs the package. ## Testing Both new lines were first written as `[ "$ROLE" = ci ] && var=...`. Under `set -euo pipefail` an AND-list whose test is false exits 1 at the top level, which aborts the script — so `--role runtime` would have died at the package step, before installing anything. They are `if` blocks, and both branches were exercised: ``` ci -> pkgs=[ipset dnsmasq] unwanted=[avahi-daemon cups] runtime -> pkgs=[] unwanted=[avahi-daemon cups dnsmasq] ``` `bash -n` passes. Not yet run end-to-end on a machine; the next runtime bootstrap is the first execution of the changed package step.

dejima-agent added 1 commit 2026-08-06 02:26:14 -07:00

Do not install a resolver on a host that will never run one 62ecc15234

Skipping install.sh on the runtime tier left the packages it needs installed
anyway. ipset then sits unused, and dnsmasq is worse than unused: the Debian
package starts a resolver bound on port 53, so the script installs a listener
and then, forty lines later, disables listeners on the grounds that "every
listener is a way in, and a CI runner needs none of these".

Both are install.sh's dependencies, and install.sh runs on one role. iptables
stays on both, because the host's own egress policy uses it either way.

Earlier runs did install dnsmasq on runtime hosts, and an upgrade that leaves
the old listener running is not one, so runtime adds it to the list of
services to disable. Disabled rather than purged: someone co-locating both
tiers on one machine still needs the package.

Both new lines were first written as `[ "$ROLE" = ci ] && var=...`, which
under set -euo pipefail aborts the script whenever the test is false - so
--role runtime would have died at the package step. They are `if` blocks.

branderson approved these changes 2026-08-06 02:26:53 -07:00

branderson merged commit 45fad53f2a into main

2026-08-06 02:26:57 -07:00

branderson referenced this issue from a commit

2026-08-06 02:26:59 -07:00

Merge pull request 'Do not install a resolver on a host that will never run one' (#9) from runtime-packages into main

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dejima/dejima-ci-hardener#9