Step 12: Containers and hosts #8
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Container and host API endpoints, Hosts and Containers pages, logs view.
Step 12 in docs/PLAN.md. Done when: merged to dev
Started step 12 on branch
containers.Base head: PLACEHOLDER_BASE
Worktree:
/mnt/hdd/infraternal/.worktrees/containersScope: local engine discovery, container/host API and UI, real Docker/Podman verification.
Correction: the base/head SHA is
dface23f67a28816794e8b59b6e7483ddc6f091a.ISSUE UPDATE kayg/infraternal#8
branch: containers
head:
76e4c85814done:
list endpoint (500 containers, smoke): p50=47 µs / p99=118 µs
gates:
PASS fast: JavaScript dependencies
PASS fast: build web app
PASS fast: cargo fmt --check
PASS fast: cargo clippy
PASS fast: cargo test
PASS fast: svelte-check
PASS fast: UI package svelte-check
PASS fast: Vitest
PASS fast: UI package Vitest
PASS fast: OpenAPI and TypeScript client drift
PASS integration: JavaScript dependencies
PASS integration: build web app
PASS integration: build release binary
PASS integration: real HTTP behavior
PASS integration: Docker socket _ping
PASS integration: rootless Podman socket _ping
PASS integration: engine adapters against Docker and Podman
PASS integration: resource HTTP API against Docker and rootless Podman
PASS browser: JavaScript dependencies
PASS browser: install Chromium and system dependencies
PASS browser: build web app
PASS browser: build release binary
PASS browser: Playwright against release server
PASS bench: JavaScript dependencies
PASS bench: build web app
PASS bench: criterion smoke (numbers from this VM are not reportable)
PASS bench: proto codec criterion smoke (numbers from this VM are not reportable)
PASS bench: engine adapter criterion smoke (numbers from this VM are not reportable)
PASS bench: container list filter 500-row criterion smoke (numbers from this VM are not reportable)
screenshots:
open problems: none
Build job
containers(gpt-5.6-luna/max) finished:Report lacks verbatim gate lines; the review re-runs them. Independent review
containers-reviewrunning.Starting independent review of step 12 (containers and hosts). Worktree is detached at
76e4c85814(containers review); review range is dev...HEAD with stated basedface23. Review-only: no tracked-file edits or commits. I will run the required gates and exercise the release binary, API authorization/idempotency/audit paths, HTTP list performance, and browser/accessibility flow.Gate finding (blocking): PASS fast: JavaScript dependencies
PASS fast: build web app
PASS fast: cargo fmt --check
PASS fast: cargo clippy
PASS fast: cargo test
PASS fast: svelte-check
PASS fast: UI package svelte-check
PASS fast: Vitest
PASS fast: UI package Vitest
PASS fast: OpenAPI and TypeScript client drift
PASS integration: JavaScript dependencies
PASS integration: build web app
PASS integration: build release binary
PASS integration: real HTTP behavior
PASS integration: Docker socket _ping
PASS integration: rootless Podman socket _ping
PASS integration: engine adapters against Docker and Podman
PASS integration: resource HTTP API against Docker and rootless Podman
PASS browser: JavaScript dependencies
PASS browser: install Chromium and system dependencies
PASS browser: build web app
PASS browser: build release binary
PASS browser: Playwright against release server
PASS bench: JavaScript dependencies
PASS bench: build web app
PASS bench: criterion smoke (numbers from this VM are not reportable)
PASS bench: proto codec criterion smoke (numbers from this VM are not reportable)
PASS bench: engine adapter criterion smoke (numbers from this VM are not reportable)
PASS bench: container list filter 500-row criterion smoke (numbers from this VM are not reportable) failed at . Evidence: panicked at asserting Docker image ID equals Podman image ID; left , right . Four preceding engine integration tests passed; this test ran 63.90s. The required gate therefore exited 1.
The first review run (
containers-review) died when /mnt/hdd filled up (per-worktree Rust targets). Merged steps' worktrees were removed (64 GB free) and the review relaunched ascontainers-review2, continuing from its saved screenshots.Review started for kayg/infraternal#8.
76e4c85814dface23; current dev:8e98a4679eConfirmed findings from the release-browser/API run at
76e4c85814:GET /api/v1/containers?engine=docker("10") causedGET ...?engine=podmanwithIf-None-Matchto return 304 and no body; filtered representations collide.hasOpenTerminal: false).Evidence is appended to
/mnt/hdd/infraternal/artifacts/containers-review/findings.md.Additional confirmed findings:
resolve_containerinspects the engine before checkingcontainers:read, violating the visible-set lookup order and leaving hidden-existing targets on an engine/timing path (crates/server/src/resources.rs:1006-1034). The corrected probe returned identical 404/container bodies for hidden-existing and missing IDs, but the authorization gate is still after the engine call.crates/server/src/resources.rs:1240-1242), despite the contract requiring tags in the authorization hash.resources.rs:388-396,auth.rs:188-196), so a crash before auth/validation/audit/engine dispatch can incorrectly recover as unknown.Fact.sveltehas no title/full-value mechanism.Focused probe result: hidden-existing and missing both returned 404/not_found/container; filtered ETag collision reproduced; 500-container HTTP list measured p50 7.90 ms / p99 11.90 ms over 110 uncached samples.
ISSUE UPDATE kayg/infraternal#8
review of: containers @
76e4c85814verdict: reject
gates:
PASS fast: JavaScript dependencies
PASS fast: build web app
PASS fast: cargo fmt --check
PASS fast: cargo clippy
PASS fast: cargo test
PASS fast: svelte-check
PASS fast: UI package svelte-check
PASS fast: Vitest
PASS fast: UI package Vitest
PASS fast: OpenAPI and TypeScript client drift
PASS integration: JavaScript dependencies
PASS integration: build web app
PASS integration: build release binary
PASS integration: real HTTP behavior
PASS integration: Docker socket _ping
PASS integration: rootless Podman socket _ping
PASS integration: engine adapters against Docker and Podman
PASS integration: resource HTTP API against Docker and rootless Podman
PASS browser: JavaScript dependencies
PASS browser: install Chromium and system dependencies
PASS browser: build web app
PASS browser: build release binary
PASS browser: Playwright against release server
PASS bench: JavaScript dependencies
PASS bench: build web app
PASS bench: criterion smoke (numbers from this VM are not reportable)
PASS bench: proto codec criterion smoke (numbers from this VM are not reportable)
PASS bench: engine adapter criterion smoke (numbers from this VM are not reportable)
PASS bench: container list filter 500-row criterion smoke (numbers from this VM are not reportable)
list endpoint over HTTP (500 containers): p50 7.90 ms / p99 11.90 ms (110 uncached samples; 500 returned)
screenshots: /mnt/hdd/infraternal/artifacts/containers-review/ (40 PNGs across light/dark at 1440x900, 1024x768, 390x844, 320x640)
findings:
cleanup: no review-labeled Docker or Podman containers remain; review server stopped; worktree clean.
Supplemental final verification: Chromium accessibility-tree snapshots and keyboard tab traversal covered Dashboard, Containers, Hosts, container detail, and host detail. Form controls, navigation, filters, sort buttons, row action buttons, and page actions had accessible names; the Table tree exposed named Stop/Start/Restart/Remove buttons. The only keyboard failure remains the already reported nested-row action activation. No review-labeled Docker or Podman containers remain, the release server is stopped, and
git status --shortis empty. Added finding 11: the Containers UI has no host filter despite the UI/API contract requiring one.Correction to finding 10: the accessibility-tree pass exposed the full image/ID text, so assistive technology has the value. The remaining issue is visual-only recovery: the 390px detail view ellipsizes long SHA values and
Fact.svelteprovides no title/tooltip or other sighted-user way to reveal them.Review
containers-review2(gpt-5.6-luna/max): reject. List endpoint over real HTTP, 500 containers: p50 7.90 ms / p99 11.90 ms (budget p99 20 ms; smoke on the dev VM, not reportable).Details:
Containers review findings
Fix round started on branch
containersfrom base76e4c858142eba9af497f56dd8df40acc62fe4af; mergingdevat8d5000d2418e554a66e1710153675001544cdd86before implementation. Scope is all eleven independent-review findings for step 12, with fail-first authorization regressions, browser coverage at the requested narrow widths, and a finalscripts/verify all.Fix round complete.
branch:
containersbase:
76e4c858142eba9af497f56dd8df40acc62fe4afplus merge ofdevat8d5000d2418e554a66e1710153675001544cdd86head:
48dc6deed8493d90b0d3bb647848c3aaaee589caFindings fixed:
title; long detail descriptions wrap.Regression evidence:
regression_tests: compile failed becausefiltered_etagdid not exist andauthorization_hashaccepted no tags; after the fix both tests pass.dispatched_at_ms IS NULLand passes.UI skill rules applied: native keyboard semantics and visible focus; critical controls kept in normal visible flow; priority-based progressive disclosure; project spacing/type/color tokens reused; truncation always has full-value recovery; information-first copy; no keyboard-triggered motion.
Final
scripts/verify alloutput:The first unchanged all-gate attempt saw two merged SSH PTY tests time out; both passed immediately in isolated reruns, and the complete unchanged
scripts/verify allrerun above passed.Screenshots:
/mnt/hdd/infraternal/artifacts/containers-fix/(light/dark dashboard; container list at 1440/1024/390/320 coverage; host and container details, including 390×844 detail).Leftovers: Docker and Podman queries for label
infraternal.testreturned none; owner containers labeledinfraternal.demo=1were untouched.Open problems: none.
Fix job
containers-fix(gpt-5.6-sol/medium) finished (31 gate steps PASS, none FAIL):Verification start: branch containers-review (detached), base head
48dc6deed8; verifying fixes 76e4c85..48dc6de. Verification-only: no tracked-file edits or commits.Verification findings at
48dc6de:1 fixed — real HTTP/browser cross-filter check sent the Docker ETag to engine=podman and got 200 with a distinct ETag; new filtered_etag regression test passed.
2 fixed — Playwright focused Stop and activated it with Space and Enter; both opened the confirmation dialog, and the lifecycle action completed.
3 fixed — Playwright table-fit assertions passed at desktop/medium/mobile/narrow; custom 1440 run measured tableRight=1392 <= viewport 1440, Actions width=144.016, clipped=[]; 390px screenshot shows Actions controls.
4 later (partial) — host detail screenshot now shows the Containers section and five real rows, but still exposes only Back to hosts; no Open terminal action.
5 fixed — browser screenshots and assertions show Container details and Host details breadcrumbs instead of Dashboard.
6 later (partial) — dashboard screenshot has real Hosts/Containers/Engines/Inbox counts, unhealthy count, Needs attention and Recent activity sections; CPU/memory/disk remain — with Telemetry is not reported, and activity says the audit-log API is not landed. Marketing intro is absent.
7 fixed — own source-order test failed at
76e4c85(visibility line after engine lookup) and passed at48dc6de(visibility before engine lookup).8 fixed — own host-tag authorization test failed at
76e4c85and passed at48dc6de; the new Rust regression test also passed.9 fixed — auth/resource dispatch fences are marked from handlers after validation/authorization/audit; auth and real-resource HTTP tests assert rejected/plan-required requests have no dispatch fence.
10 fixed — custom Playwright detail check found long values with title recovery (71/71 chars for Image and Image ID); detail screenshot shows deliberate ellipsis.
11 fixed — host filter is present and functional in desktop/mobile screenshots and Playwright checks.
blocks-merge: none
later: 4, 6
ISSUE UPDATE kayg/infraternal#8
verify of: containers @
48dc6deed8verdict: merge
gates:
PASS fast: JavaScript dependencies
PASS fast: build web app
PASS fast: cargo fmt --check
PASS fast: cargo clippy
PASS fast: cargo test
PASS fast: svelte-check
PASS fast: UI package svelte-check
PASS fast: Vitest
PASS fast: UI package Vitest
PASS fast: OpenAPI and TypeScript client drift
PASS integration: JavaScript dependencies
PASS integration: build web app
PASS integration: build release binary
PASS integration: real HTTP behavior
PASS integration: Docker socket _ping
PASS integration: rootless Podman socket _ping
PASS integration: engine adapters against Docker and Podman
PASS integration: resource HTTP API against Docker and rootless Podman
PASS integration: SSH contract against real sshd
PASS browser: JavaScript dependencies
PASS browser: install Chromium and system dependencies
PASS browser: build web app
PASS browser: build release binary
PASS browser: Playwright against release server
PASS bench: JavaScript dependencies
PASS bench: build web app
PASS bench: criterion smoke (numbers from this VM are not reportable)
PASS bench: proto codec criterion smoke (numbers from this VM are not reportable)
PASS bench: SSH PTY criterion smoke (numbers from this VM are not reportable)
PASS bench: engine adapter criterion smoke (numbers from this VM are not reportable)
PASS bench: container list filter 500-row criterion smoke (numbers from this VM are not reportable)
findings:
1 → fixed — filtered Docker-to-Podman HTTP conditional request returned 200 with a distinct ETag; regression test passed.
2 → fixed — Playwright Space and Enter activation both opened the Stop confirmation and the lifecycle flow completed.
3 → fixed — table-fit checks passed at 1440/1024/768/390/320; custom 1440 measured tableRight 1392, Actions width 144.016, clipped [].
4 → not fixed (partial, later) — host detail has five containers but no Open terminal action.
5 → fixed — browser breadcrumbs show Container details and Host details.
6 → not fixed (partial, later) — real status/count sections and attention/activity shells exist, but telemetry is — and audit activity is unavailable; marketing intro is gone.
7 → fixed — own before/after order test failed at
76e4c85and passed at48dc6de.8 → fixed — own before/after host-tag authorization test failed at
76e4c85and passed at48dc6de; Rust regression passed.9 → fixed — auth/resource HTTP checks show rejected or plan-required mutations have no dispatch fence.
10 → fixed — long Image/Image ID values have title recovery; Playwright measured 71/71-character title coverage.
11 → fixed — Host filter is present and functional at desktop and mobile widths.
list endpoint over HTTP (500 containers): p50=5.347 ms, p99=10.618 ms (100 full-body GETs; 500 labeled throwaways, 504 total visible; dev VM observation)
blocks-merge: none
later: 4, 6
Verify
containers-verify: merge (all gates passed; list over HTTP, 500 containers, dev VM smoke: p50 5.347 ms / p99 10.618 ms). Merged to dev on the VM (76e4452); orchestrator re-ran fast (10/10) and integration (9/9) on the merge head. Step 12 done. Later: 4 (host terminal action, needs step 13) and 6 (dashboard sparklines).Gate weakness found:
scripts/verifyinstalls JS dependencies only when node_modules is missing, not when bun.lock changed, so a stale checkout failsbuild web appafter a dependency is added.Orchestrator: I reviewed the screenshots from
scripts/verify browserondevatbfa8af7(gate PASS, 5/5 steps). The screenshots are in/mnt/hdd/infraternal/artifacts/dev-browser/on the dev VM. Findings, all labeled later, to fold into step 12b (the logs view), which reworks the same pages:light-390x844-containers.png): the name column truncates to "infrater…" and the status to "Up Less th…". The Stop/Restart/Remove buttons take most of the row width, and the filter panel takes the whole first screen. On narrow widths the row needs a stacked card layout or an overflow menu for actions, and the filters should collapse.dark-1440x900-container-detail.png): a running container shows a Finished time (16:04:29.386Z) that is earlier than Started (16:04:29.728Z). Hide Finished and Exit code while the container is running.22/09/2026, 18:04:26) but Started and Finished are raw RFC 3339 UTC. Use one formatter, with the raw value on hover or in a title.repo:tagexists. Show the reference when there is one and the digest as secondary text. (The test container may be untagged; check with a tagged image.)