wg-wrap.git, branch mainwg-wrap runs commands in network namespaces configured with userspace wireguard tunnels.
https://git.theodohertyfamily.com/wg-wrap.git/atom?h=main2026-06-14T05:28:47Zdocs: add case study on agentic development workflow2026-06-14T05:28:47ZJames O'Dohertyjames@theodohertyfamily.com2026-06-14T05:28:47Zurn:sha1:04349c45dbf2b04ee89c6c99ac90152daa799097docs: update diagnostics description and add healthcheck command to README2026-06-13T18:08:14ZJames O'Dohertyjames@theodohertyfamily.com2026-06-13T18:08:14Zurn:sha1:1b23c0acbb6e4f45ce4c4e95ad295218d769f709feat: implement system preflight checks and health diagnostics2026-06-13T17:50:25ZJames O'Dohertyjames@theodohertyfamily.com2026-06-13T17:50:25Zurn:sha1:5646eca119f80f8f45ebec9fcbe666ca614ebf5d
Introduced a tiered system verification mechanism to improve reliability
and provide actionable feedback to users, avoiding false positives in
the critical execution path.
Key changes:
- Implement `CheckSystemRequirements` for critical, non-ambiguous
requirements (e.g., TUN device availability) to ensure fatal
environment issues are caught immediately during bootstrap.
- Implement a user-facing `healthcheck` command that provides
comprehensive diagnostics and actionable configuration hints for
common misconfigurations (e.g., unprivileged user namespaces,
subuid/subgid mappings, and kernel sysctls).
- Refactor the `FileSystem` interface to support full mockability,
allowing for exhaustive unit testing of diagnostic logic.
- Add comprehensive unit tests in `internal/namespace/preflight_test.go`
covering various Linux distributions, privilege levels, and
hardware availability scenarios.
- Ensure code quality through formatting, static analysis (golangci-lint),
and validation of all existing unit, integration, and E2E tests.
refactor: implement dependency injection and enable parallel testing2026-06-13T15:51:04ZJames O'Dohertyjames@theodohertyfamily.com2026-06-13T15:51:04Zurn:sha1:29621ecbd1e77e6e1a70b6b3ea8fbe3a56e47df3
This commit refactors the core system operations to use a manager-based
dependency injection pattern, eliminating global state and resolving
data races in the test suite.
Architecture:
- Introduced NetworkManager and NetworkOps interface in internal/network
to abstract netlink calls.
- Introduced MountOps and FileSystem interfaces in internal/namespace
to abstract mount and filesystem operations.
- Introduced TunnelManager in internal/wireguard to coordinate tunnel
lifecycle using the new abstractions.
- Updated internal/cli and internal/manager to use these managers.
Testing:
- Restored t.Parallel() to unit tests in internal/network and
internal/wireguard.
- Implemented setupParallelEnv and an enhanced mockFS in
wireguard_unit_test.go to ensure complete test isolation.
- Added bootstrap_test.go to verify launcher preparation logic in
internal/namespace without requiring syscall.Exec.
- Resolved data races in internal/network tests.
CLI:
- Added support for -h, --help, and -help flags for the main command.
Verification:
- Passed all tests (unit, integration, E2E).
- Verified zero data races with 'go test -race'.
- Passed golangci-lint and go vet.
feat(cli): introduce explicit run/exec subcommands to prevent typo-execution2026-06-08T02:57:34ZJames O'Dohertyjames@theodohertyfamily.com2026-06-08T02:57:34Zurn:sha1:f8afb7d5889f5c8b6ea256fd078fa8426d21c7be
Prevent the ambiguity where a mistyped subcommand was interpreted as the target
wrapped process.
- Introduce `run` and `exec` (alias) subcommands for launching wrapped processes.
- Promote internal test commands (`test-ns`, `test-args`, `test-lifecycle`) to explicit subcommands.
- Update CLI routing to return an error for unknown subcommands instead of falling back to the default execution path.
- Update `README.md` usage examples and all test suites to use the new subcommand structure.
security: restrict permissions of imported WireGuard profiles to 06002026-06-08T01:51:48ZJames O'Dohertyjames@theodohertyfamily.com2026-06-08T01:51:48Zurn:sha1:7010768877c227c9410a06908e4cb3e54db403bd
WireGuard profile files contain sensitive private keys. Previously, these files were written with 0644 permissions, making them world-readable. This commit changes the file mode to 0600 to ensure only the owner can read and write the profiles.
- Updated `handleProfileImport` to use 0600 permissions.
- Added tests to verify that imported profiles have the correct permissions.
cli: improve usage and help output2026-06-05T03:16:07ZJames O'Dohertyjames@theodohertyfamily.com2026-06-05T03:16:07Zurn:sha1:184deac4efe2062db6ecd2285ec8db1e919f9441
Implement custom usage functions to provide more comprehensive and
discoverable help messages for the top-level tool and profile
management subcommands.
- Add printUsage and printProfileUsage methods to App.
- Override FlagSet.Usage to display professional help messages.
- Ensure profile subcommands are listed in the main help output.
- Trigger profile usage on missing or invalid subcommands.
refactor: remove dependency on ip CLI tool and abstract network logic2026-06-05T03:09:46ZJames O'Dohertyjames@theodohertyfamily.com2026-06-05T03:09:46Zurn:sha1:78059b43e3d00a0f2b75677461692745cce34a63
Eliminate the external dependency on the `ip` (iproute2) command-line tool by centralizing network configuration and diagnostics within a new `internal/network` package using the `netlink` library.
Changes:
- Introduced `internal/network` package to handle network interface listing and configuration.
- Replaced `exec.Command("ip", "link")` in `internal/namespace.VerifyIsolation` with `network.ListInterfaces()`.
- Improved `VerifyIsolation` to explicitly ensure only the loopback interface is present in a fresh network namespace.
- Moved interface and routing configuration logic from `internal/wireguard` to `internal/network`.
- Removed unnecessary `os/exec` imports from network-related files.
This change increases the tool's portability by removing the requirement for `iproute2` to be installed in the target environment.
refactor: decouple namespace operations and improve test coverage2026-06-05T02:57:35ZJames O'Dohertyjames@theodohertyfamily.com2026-06-05T02:57:35Zurn:sha1:04dca5dada8c2d971ff3b54eeedc5ab6e53a29ac
- Introduce `namespace.Ops` interface to decouple `Manager` from system-level namespace operations, enabling easier unit testing via mocks.
- Add unit tests for `internal/paths` to verify path resolution logic across different environment configurations.
- Implement `EnsureBinary` helper in E2E tests to gracefully skip tests when `WG_WRAP_BIN` is not set, allowing `go test ./...` to pass in non-build environments.
- Apply project-wide formatting and fix linting issues.
refactor: simplify architecture and improve documentation2026-06-05T02:38:44ZJames O'Dohertyjames@theodohertyfamily.com2026-06-05T02:38:44Zurn:sha1:66b782e261f1cd928ad6a8482788a65fb484db45
- Extract orchestration logic from `internal/cli` into a new `internal/manager` package for better composability.
- Migrate technical implementation details from README.md to package-level godoc strings.
- Rewrite README.md to be more user-centric, focusing on quick start and usage.
- Add comprehensive documentation for exported structs and fields across the project.
- Verify all changes with `go fmt`, `go vet`, `golangci-lint`, and full E2E test suite.