bluebluesodaandCommandCodeBot
790ed11369
Empirically this is what makes discrete whitelist addresses work: - The provider binds every address on the host's NIC at boot; while the host holds an address the kernel treats it as LOCAL and drops the container's packets using it as a source (source-address validation), so outbound v6 silently fails. Pool mode now removes each pool address from the external interface (vps ip6 addr-del), on add/reinstall and every ipv6-reapply/boot — self-healing after a reboot re-binds them. - Containers get TWO NICs: eth0 = nictype routed on the external interface with ipv6.address=<pool /128> (Incus programs the /128 route + proxy_ndp + fe80::1 gateway), eth1 = bridged on incusbr0 for the shared IPv4. systemd-networkd binds the /128 statically on eth0 and DHCPv4s on eth1. - The manual bridge /128-route + proxy_ndp plumbing (SetupIPv6BridgePool, WireIPv6Pool route/neigh) is gone — Incus programs everything. Verified end-to-end on the whitelist host: container reaches out over v6 (curl -6 returns its own /128) and v4 (eth1 NAT) simultaneously, external Globalping hits the container /128 with 0% loss, delete releases the address and a new container reuses it. Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
Documentation
Technical documentation for vpsmgr. All docs are in English.
| Doc | What it covers |
|---|---|
| architecture.md | System design: components, storage, network, security, traffic, image, install/uninstall lifecycle |
| configuration.md | Full reference for /etc/vpsmgr/config.yaml |
| ipv6.md | IPv6 pass-through design: deterministic addresses, prefix support, routing, installer flow |
| development.md | Building, testing, releasing, conventions |
See also AGENTS.md at the repo root — short version aimed at AI coding agents.