wg-wrap.git/tests, branch mainwg-wrap runs commands in network namespaces configured with userspace wireguard tunnels.
https://git.theodohertyfamily.com/wg-wrap.git/atom?h=main2026-06-08T02:57:34Zfeat(cli): introduce explicit run/exec subcommands to prevent typo-execution2026-06-08T02:57:34ZJames O'Dohertyjames@theodohertyfamily.com2026-06-08T02:57:34Zurn:sha1:f8afb7d5889f5c8b6ea256fd078fa8426d21c7be
Prevent the ambiguity where a mistyped subcommand was interpreted as the target
wrapped process.
- Introduce `run` and `exec` (alias) subcommands for launching wrapped processes.
- Promote internal test commands (`test-ns`, `test-args`, `test-lifecycle`) to explicit subcommands.
- Update CLI routing to return an error for unknown subcommands instead of falling back to the default execution path.
- Update `README.md` usage examples and all test suites to use the new subcommand structure.
refactor: decouple namespace operations and improve test coverage2026-06-05T02:57:35ZJames O'Dohertyjames@theodohertyfamily.com2026-06-05T02:57:35Zurn:sha1:04dca5dada8c2d971ff3b54eeedc5ab6e53a29ac
- Introduce `namespace.Ops` interface to decouple `Manager` from system-level namespace operations, enabling easier unit testing via mocks.
- Add unit tests for `internal/paths` to verify path resolution logic across different environment configurations.
- Implement `EnsureBinary` helper in E2E tests to gracefully skip tests when `WG_WRAP_BIN` is not set, allowing `go test ./...` to pass in non-build environments.
- Apply project-wide formatting and fix linting issues.
clean up debugging prints and silence successful execution output2026-06-04T04:21:56ZJames O'Dohertyjames@theodohertyfamily.com2026-06-04T04:21:56Zurn:sha1:c53503b52b6fc6de37b6053719521054003fa50b
- Remove leftover DEBUG prints from CLI and wireguard internal packages.
- Silence stdout during successful command wrapping to ensure only the wrapped command's output is visible.
- Redirect all warnings and internal errors to stderr.
- Implement a verbose mode via `WG_WRAP_VERBOSE=1` to enable tunnel status messages.
- Update E2E tests to use verbose mode for verification of tunnel lifecycle events.
- Fix errcheck linting issue in wireguard.go and apply go fmt.
fix: resolve resource leaks and improve namespace lifecycle management2026-06-04T03:45:45ZJames O'Dohertyjames@theodohertyfamily.com2026-06-04T03:45:45Zurn:sha1:51a0845adba702ac02437405988b24b3b2c9fb45
- Fix DNS resolver leaks by creating temporary resolv.conf files within the profile's runtime directory and ensuring robust cleanup.
- Fix isolation block directory leaks by explicitly removing the block directory during namespace unpinning.
- Improve namespace lifecycle management:
- Register processes before joining an active namespace to prevent race conditions in reference counting.
- Update `IsLastProcess` and corresponding tests to reflect the unregister-then-check cleanup flow.
- Improve test reliability and correctness:
- Convert `TestAppRun_ProfileDirInjection` to use separate binary execution, preventing process replacement and ensuring `t.TempDir()` cleanup.
- Replace hardcoded test configuration paths with `t.TempDir()` in `mount_leak_test.go`.
- Implement `SetEnvOverrides` helper for cleaner environment variable management in E2E tests.
- Improve E2E lifecycle tests with better environment handling and output redirection.
refactor: rename module to git.theodohertyfamily.com/wg-wrap and apply public domain license2026-05-30T03:35:21ZJames O'Dohertyjames@theodohertyfamily.com2026-05-30T03:35:21Zurn:sha1:da70b10fbd056f19d892acad542ce96c40c58389
- Update go.mod and all internal imports to reflect the new module path
- Add LICENSE file with the Unlicense (public domain dedication)
- Increase timeouts in e2e lifecycle tests to prevent flaky failures
- Verify all tests, linting, and formatting pass with the new module name
refactor: tidy project and stabilize E2E lifecycle tests2026-05-30T03:27:50ZJames O'Dohertyjames@theodohertyfamily.com2026-05-30T03:27:50Zurn:sha1:328a42144fd54ac99d1bf231e6114147e48b820f
- Improve routing logic in CLI for better readability.
- Resolve flakiness in `TestNamespaceLifecycleAutomation` by increasing polling timeouts and adjusting tick intervals.
- Verify project state with `go fmt`, `go vet`, and `golangci-lint`.
- Ensure all unit and E2E tests pass deterministically.
fix: resolve deadlocks, routing errors, and test timings in test suite2026-05-30T01:24:42ZJames O'Dohertyjames@theodohertyfamily.com2026-05-30T01:24:42Zurn:sha1:b098e2845b68ce90f34e4e1e927b4914d0b00ef7
- fix(cli): resolve Flock self-deadlock in ExecuteCommand cleanup by reusing the existing lockFile handle if already held during premature exit.
- fix(wireguard): configure explicit default route destination (0.0.0.0/0 for IPv4 and ::/0 for IPv6) to avoid netlink "either Dst.IP, Src.IP or Gw must be set" error.
- fix(wireguard): initialize the Tunnel return parameter in StartTunnel to prevent a nil pointer dereference.
- test(e2e): fix argument ordering in waitForLifecycle to pass "test-lifecycle" first, and increase sleep duration of dummy processes to 1.0s to ensure reliable process persistence under race detection.
perf: optimize test suite execution and reduce polling2026-05-30T01:16:13ZJames O'Dohertyjames@theodohertyfamily.com2026-05-30T01:16:13Zurn:sha1:0f3806f77164af99466bfc8c0d7d5f85f9ec078f
- Added `test-lifecycle` CLI command to verify active session state.
- Replaced manual filesystem polling and `time.Sleep` in E2E tests with `waitForLifecycle` synchronization.
- Optimized `TestConfigHotSwap` by reducing artificial sleep durations.
- Fixed linting issue (ST1023) in `internal/cli/cli.go`.
These changes reduce total test execution time to under 15 seconds and improve the determinism of lifecycle verification.
feat: harden bootstrap and optimize network data path2026-05-30T01:07:46ZJames O'Dohertyjames@theodohertyfamily.com2026-05-30T01:07:46Zurn:sha1:d2173cdbc03884ecd9534e9369f8ebe1634f7e9c
- Security: Eliminate namespace escape risk by removing `HostBind` and enforcing `FDBind` using pre-opened host socket FDs.
- Security: Replace unsafe `atoi` with `strtol` and strict validation in the C launcher to prevent malformed PID joins.
- Stability: Fix PID wraparound by storing session timestamps in PID files to detect recycled PIDs.
- Stability: Resolve DNS mount leaks by implementing proper unmounting of `/etc/resolv.conf` during tunnel shutdown.
- Performance: Optimize `FDBind` throughput by implementing batch packet processing in the receive loop.
- Deployment: Implement `memfd_create` for the C launcher to support `noexec` temporary directories and reduce disk I/O.
- Maintenance: Replace external `ip` CLI dependency with native `netlink` library for robust network configuration.
- Quality: Fix all `golangci-lint` errors and replace remaining panics with explicit error handling.
feat: implement robust namespace lifecycle and resilience suite2026-05-30T00:35:31ZJames O'Dohertyjames@theodohertyfamily.com2026-05-30T00:35:31Zurn:sha1:d4cec92f5690a60b3509ab718bdea72dc520110e
- Replace marker-file pinning with kernel bind-mount anchors for reliable namespace persistence.
- Implement atomic "last-man-out" cleanup sequence using ProfileLock, preventing namespace leaks and race conditions.
- Add comprehensive resilience test suite covering:
- Crash recovery from stale runtime state.
- Host network change stability.
- Configuration hot-swap session persistence.
- Resource exhaustion and high-churn lifecycle stress.
- Align documentation and test expectations with rootless session-based persistence.
- Fix argument integrity and isolation leaks.
- Ensure 100% pass rate for all E2E and integration tests.