From c4126464980e886399784ce3bfd5b55c7f5b4ee2 Mon Sep 17 00:00:00 2001 From: Johnathan Corgan Date: Sat, 9 May 2026 18:22:22 +0000 Subject: [PATCH] testing: pre-create /run/fips/ in the unified test image Mirrors systemd's RuntimeDirectory=fips so the daemon's resolve_default_socket() picks /run/fips/control.sock inside containers, matching production layout and the path that the chaos sim harness (testing/chaos/sim/control.py) probes. Without this, the resolver falls through to /tmp/fips-control.sock (no /run/fips, no XDG_RUNTIME_DIR), the daemon binds there, and the harness's hardcoded /run/fips/control.sock probe returns FileNotFoundError on every node. chaos-bloom-storm then fails its bloom_send_rate assertion with start=0 nodes, end=0 nodes; other chaos scenarios pass only because their tolerances absorb the empty samples. Production hosts always have /run/fips materialized by the fips.service unit's RuntimeDirectory directive before the daemon starts, which is why the regression hit only the containerized test path. Verified locally with chaos-bloom-storm: max per-node delta 27 <= ceiling 30 over the trailing 30s window. --- testing/docker/Dockerfile | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/testing/docker/Dockerfile b/testing/docker/Dockerfile index bacd89a..7247133 100644 --- a/testing/docker/Dockerfile +++ b/testing/docker/Dockerfile @@ -39,6 +39,11 @@ RUN printf '%s\n' \ COPY fips fipsctl fipstop fips-gateway /usr/local/bin/ RUN chmod +x /usr/local/bin/fips /usr/local/bin/fipsctl /usr/local/bin/fipstop /usr/local/bin/fips-gateway +# Mirror systemd's RuntimeDirectory=fips so the daemon's resolver picks +# /run/fips/control.sock — matches production layout and the chaos sim +# harness probe path (testing/chaos/sim/control.py). +RUN mkdir -p /run/fips + # Static web page for HTTP server (chaos/static modes) RUN printf 'Fuck IPs!\n' > /root/index.html