Repository navigation
LXC: live E2E for schema 0.8 directional egress covers only IPv4 #1001
Description
Activity
Triage complete.
Labels applied:
OS-Linux,Container-Process,Area-Test-ExecutorAssigned:
@SohamDas2021(Linux/LXC owner) and@theelliotm(executor test infrastructure owner)This issue tracks missing live E2E coverage for schema 0.8 directional egress on LXC: IPv6 peers, ICMP/ICMPv6, port ranges, and
protocol: anyare currently covered only by unit assertions and need live cases inrun_lxc_network_ga_egress_test.sh.Maintainers: Comment
/investigateto check whether this issue or bug is valid against the most current code. Copilot will also produce a report with the changes that will be needed. For a small, unambiguous documentation or test fix, it may also create one draft PR.Generated by 🏷️ Issue Triage for #1001 · sonnet46 · 20.2 AIC · ⌖ 5.4 AIC · ⊞ 7.6K · ◷
- assigned and unassigned
on Aug 22, 2026 - assigned and unassigned
on Sep 21, 2026
Raised on #983 independently by Branden Bonaby (@bbonaby) (marked for follow-up) and Soham Das (@SohamDas2021) (marked non-blocking).
What is covered today
tests/scripts/run_lxc_network_ga_egress_test.shexercises the directional egress path against a real LXC container, and every case in it is IPv4.What is not
ip6tablespath for a directional peer is covered only by unit assertions.portwithendPort).protocol: any.These are rule-level assertions only. Nothing proves the argument vectors the unit tests check actually produce the intended behavior on a live host.
Suggested shape
Add live cases to the GA egress script covering at least one IPv6 allow and one IPv6 deny with directional peers, plus one ICMP case and one port-range case. Wire them into
tests/scripts/run_lxc_all_tests.shalongside the existing entry.