thaloco/banger
1
Fork 0
Code Pull requests Releases Packages Activity Actions

Add vsock-backed VM port inspection

Browse source 
Let the host ask the guest vsock agent to run ss so open ports can be surfaced without SSHing in manually.

Add a narrow /ports agent endpoint, a daemon vm.ports RPC that enriches listeners with <hostname>.vm endpoints and best-effort HTTP links, and a concurrent 'banger vm ports' CLI table for one or more VMs.

Update the guest package contract to include ss for rebuilt Debian images, allow the guest agent package in the shell-out policy, and cover the new parsing/RPC/CLI flow in tests.

Verified with GOCACHE=/tmp/banger-gocache go test ./... outside the sandbox, make build, bash -n customize.sh make-rootfs-void.sh verify.sh, and ./banger vm ports --help.
This commit is contained in:
Thales Maciel 2026-03-19 15:52:11 -03:00
parent 3ed78fdcfc
commit c298ed2fc1
No known key found for this signature in database
GPG key ID: 33112E6833C34679
11 changed files with 1029 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

5
internal/policy/shellout_test.go
View file

@ -54,12 +54,13 @@ func TestExecImportsStayInsideApprovedPackages(t *testing.T) {
t.Fatalf("walk repo: %v", err)
}
if len(offenders) != 0 {
t.Fatalf("os/exec imports are only allowed in internal/cli, internal/firecracker, and internal/system; found %v", offenders)
t.Fatalf("os/exec imports are only allowed in internal/cli, internal/firecracker, internal/system, and internal/vsockagent; found %v", offenders)
}
}
func allowedExecImportPath(relPath string) bool {
return strings.HasPrefix(relPath, "internal/cli/") ||
strings.HasPrefix(relPath, "internal/firecracker/") ||
strings.HasPrefix(relPath, "internal/system/")
strings.HasPrefix(relPath, "internal/system/") ||
strings.HasPrefix(relPath, "internal/vsockagent/")
}