Deep Review: 20260430-134246-pr-37

		<-ctx.Done()
		l.Close()
	}()

	for {
		conn, err := l.Accept()
		if err != nil {
			if ctx.Err() != nil {
				return
			}
			log.Printf("rdd-guest: accept: %v", err)
			continue
		}
		go handleConn(ctx, conn)
	}
}

// TODO: once rancher-desktop-daemon is public, replace the inlined halfCloser,

 		conn, err := l.Accept()
 		if err != nil {
 			if ctx.Err() != nil {
 				return
 			}
 			log.Printf("rdd-guest: accept: %v", err)
+			time.Sleep(100 * time.Millisecond)
 			continue
 		}

	go func() {
		<-ctx.Done()
		l.Close()
	}()

	for {
		conn, err := l.Accept()
		if err != nil {
			if ctx.Err() != nil {
				return
			}
			log.Printf("rdd-guest: accept: %v", err)
			continue
		}
		go handleConn(ctx, conn)
	}
}

// TODO: once rancher-desktop-daemon is public, replace the inlined halfCloser,
// pipe(), and handleConn() here with a direct import of pkg/socketbridge, which
// contains the implementations (HalfCloser interface, Pipe function).

The author added a sync.WaitGroup inside pipe() (main.go:99-114), which serializes the two forward goroutines — but the handleConn goroutines launched at line 51 are still untracked at the program level. When SIGTERM arrives, <-ctx.Done() closes the listener, Accept errors, the loop returns, and main exits with active connections mid-io.Copy. The OS reaps their fds, peers see an abortive close instead of the bidirectional half-close drain pipe was carefully written to deliver. Long-running Docker calls (exec, attach, events, logs -f, image pulls) get truncated mid-stream.

	}

	if *enableContainerd &&
		*enableDocker {
		log.Fatal("requires either -docker or -containerd but not both.")
	}

	if err := runAgent(
		*enableContainerd, *enableDocker, *enableKubernetes,
		*containerdSock, *configPath, *k8sServiceListenerAddr,
		*adminInstall, *k8sAPIPort, *tapIfaceIP,
	); err != nil {
		log.Fatal(err)
	}

	log.Info("Rancher Desktop Agent Shutting Down")
}

func runAgent(
	enableContainerd, enableDocker, enableKubernetes bool,
	containerdSock, configPath, k8sServiceListenerAddr string,
	adminInstall bool,
	k8sAPIPort, tapIfaceIP string,
) error {
	groupCtx, cancel := context.WithCancel(context.Background())
	defer cancel()

The internal WaitGroup is the right primitive — it just needs to live one scope up.

 func main() {
     ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
     defer stop()
     ...
+    var wg sync.WaitGroup
     for {
         conn, err := l.Accept()
         if err != nil {
             if ctx.Err() != nil {
+                wg.Wait()
                 return
             }
             log.Printf("rdd-guest: accept: %v", err)
             continue
         }
-        go handleConn(ctx, conn)
+        wg.Add(1)
+        go func() {
+            defer wg.Done()
+            handleConn(ctx, conn)
+        }()
     }
 }

A short systemd TimeoutStopSec= in the unit caps the drain so a stuck connection cannot wedge systemctl restart.

(suggestion, gap) — round 1 S5 unaddressed. Re-raised at the same severity per the Step 5 prior-round-suggestions gate. The round-1 framing (Gemini) named the same shape; the author's partial fix (WG inside pipe) suggests the issue was acknowledged.

/root/build/
*.qcow2.xz
*.raw.xz
*.tar.xz

The committed binary from round 1 is gone (git ls-files src/rdd-guest/ returns only go.mod, go.sum, main.go), so the runtime concern is resolved. The companion fix — adding the path to .gitignore so a developer's go build inside src/rdd-guest/ does not stage the artifact again — is still missing. Jan's PR comment explicitly called this out as the one item to address.

 /root/build/
 *.qcow2.xz
 *.raw.xz
 *.tar.xz
+/src/rd-init/rd-init
+/src/rdd-guest/rdd-guest

(suggestion, gap) — round 1 I1 demoted to suggestion: the binary itself is gone, only the ignore-rule remains.

// Package main is the rdd-guest agent that runs inside the Lima/WSL2 VM.
// It listens on a vsock port and forwards connections to the Docker socket,
// enabling the Windows host to reach /var/run/docker.sock via Hyper-V vsock.
//
package main

import (
	"context"
	"errors"
	"io"

Two issues in the same block. The godoc convention for main packages is // Command <name> is …; src/rd-init/main.go:1 already uses // Command rd-init is a minimal implementation of cloud-init to start lima., so this PR diverges from local style. @mook-as raised this inline (discussion_r3163651500) and it remains unresolved. Separately, rdd-guest.service:4 is gated by ConditionVirtualization=wsl and config.sh:124 enables the service only inside the wsl profile, so "Lima/WSL2" oversells the supported runtime path (round 1 S1).

// Command rd-init is a minimal implementation of cloud-init to start lima.
// Note that this only implements `cloud-init-local`.
package main

import (
	"context"

[Unit]
Description=Rancher Desktop Guest Socket Bridge
Documentation=https://github.com/rancher-sandbox/rancher-desktop-daemon
ConditionVirtualization=wsl

[Service]
ExecStart=/usr/local/bin/rdd-guest
Restart=on-failure
RestartSec=5s

    # Enable network namespace
    systemctl enable network-setup
    systemctl enable rancher-desktop-guest-agent.service
    systemctl enable wsl-proxy.service
    systemctl enable rdd-guest.service
    # Do not manage /tmp; that is managed by WSL.
    mkdir -p /usr/local/lib/tmpfiles.d
    touch /usr/local/lib/tmpfiles.d/fs-tmp.conf
fi

-// Package main is the rdd-guest agent that runs inside the Lima/WSL2 VM.
-// It listens on a vsock port and forwards connections to the Docker socket,
-// enabling the Windows host to reach /var/run/docker.sock via Hyper-V vsock.
-//
+// Command rdd-guest is the agent that runs inside the WSL2 VM. It listens on
+// a vsock port and forwards connections to the Docker socket, enabling the
+// Windows host to reach /var/run/docker.sock via Hyper-V vsock.
 package main

(suggestion, gap) — supersedes round 1 S1.

func pipe(a, b halfCloser) {
	var wg sync.WaitGroup

	forward := func(dst, src halfCloser) {
		defer wg.Done()
		_, err := io.Copy(dst, src)
		if err != nil && !errors.Is(err, io.EOF) {
			log.Printf("rdd-guest: copy: %v", err)
		}
		_ = dst.CloseWrite()
	}

	wg.Add(2)
	go forward(a, b)

io.Copy's contract guarantees that EOF on src is not surfaced as an error: "A successful Copy returns err == nil, not err == EOF, because Copy is defined to read from src until EOF, it does not treat an EOF from Read as an error to be reported." So errors.Is(err, io.EOF) is unreachable under the documented contract; any non-nil err here represents a genuine fault (ECONNRESET, EPIPE, write error to a closed dst) worth logging. The check also drags in errors purely for this unreachable branch.

 		_, err := io.Copy(dst, src)
-		if err != nil && !errors.Is(err, io.EOF) {
+		if err != nil {
 			log.Printf("rdd-guest: copy: %v", err)
 		}

After the change, the errors import becomes unused — drop it from the import block.

(suggestion, enhancement)

Description=Rancher Desktop Guest Socket Bridge
Documentation=https://github.com/rancher-sandbox/rancher-desktop-daemon
ConditionVirtualization=wsl

[Service]
ExecStart=/usr/local/bin/rdd-guest
Restart=on-failure
RestartSec=5s

[Install]
WantedBy=rancher-desktop.target

config.sh:124 enables rdd-guest.service for every WSL image, but the bridge proxies /var/run/docker.sock — which only exists when CONTAINER_ENGINE=moby. The repo's convention for engine-conditional units is an ExecCondition against ${CONTAINER_ENGINE}, e.g. docker.service.d/conditional.conf:3:

    # Enable network namespace
    systemctl enable network-setup
    systemctl enable rancher-desktop-guest-agent.service
    systemctl enable wsl-proxy.service
    systemctl enable rdd-guest.service
    # Do not manage /tmp; that is managed by WSL.
    mkdir -p /usr/local/lib/tmpfiles.d
    touch /usr/local/lib/tmpfiles.d/fs-tmp.conf
fi

# Only enable docker if desired
[Service]
ExecCondition=test ${CONTAINER_ENGINE} = moby

ExecCondition=test ${CONTAINER_ENGINE} = moby

buildkitd.service:10-11 and containerd.service.d/conditional.conf:3 follow the same pattern with containerd. In containerd mode today, rdd-guest accepts a host-side connection, dials a non-existent Docker socket, logs a per-connection dial error, and closes — net effect is journal noise, not a functional bug. Adopting the project pattern is the cleaner fix.

Requires=buildkitd.socket
StopPropagatedFrom=rancher-desktop.target

[Service]
Type=notify
EnvironmentFile=-/etc/sysconfig/rancher-desktop
ExecCondition=test ${CONTAINER_ENGINE} = containerd
ExecStart=/usr/local/bin/buildkitd \
  --oci-worker=false --containerd-worker=true \
  --containerd-worker-addr=/run/k3s/containerd/containerd.sock \
  --addr fd://

# Only enable containerd if it is the selected container engine.
[Service]
ExecCondition=test ${CONTAINER_ENGINE} = containerd

 [Service]
+EnvironmentFile=-/etc/sysconfig/rancher-desktop
+ExecCondition=test ${CONTAINER_ENGINE} = moby
 ExecStart=/usr/local/bin/rdd-guest
 Restart=on-failure
 RestartSec=5s

(suggestion, enhancement)

	"syscall"

	"github.com/mdlayher/vsock"
)

const (
	vsockPort     = 6660
	dockerSockPath = "/var/run/docker.sock"
)

func main() {
	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
	defer stop()

6660 must stay in lockstep with the dial port in rancher-desktop-daemon. Drift between the two ends produces a silent connect-refused on the Windows side with no in-tree breadcrumb pointing at the matching constant. Other vsock ports in this repo (src/go/networking/cmd/host/switch_windows.go:46-47, src/go/networking/cmd/network/setup_linux.go:60-61) at least appear in pairs in the same repo; this one does not. A one-line comment naming the daemon-side counterpart shortens future debugging and survives the eventual pkg/socketbridge import.

	virtualSubnet     string
	staticPortForward arrayFlags
)

const (
	vsockListenPort    = 6656
	vsockHandshakePort = 6669
	timeoutSeconds     = 5 * 60
)

func main() {
	flag.BoolVar(&debug, "debug", false, "enable additional debugging")

}

const (
	nsenter                 = "/usr/bin/nsenter"
	unshare                 = "/usr/bin/unshare"
	vsockHandshakePort      = 6669
	vsockDialPort           = 6656
	defaultTapDevice        = "eth0"
	WSLVeth                 = "veth-rd-wsl"
	WSLVethIP               = "192.168.143.2"
	namespaceVeth           = "veth-rd-ns"
	namespaceVethIP         = "192.168.143.1"

 const (
+    // vsockPort must match the dial port used by rancher-desktop-daemon's
+    // socket bridge (cmd/rdd-host).
     vsockPort     = 6660
     dockerSockPath = "/var/run/docker.sock"
 )

(suggestion, enhancement)

module github.com/rancher-sandbox/rancher-desktop-opensuse/src/rdd-guest

go 1.23.0

require github.com/mdlayher/vsock v1.2.1

require (
	github.com/mdlayher/socket v0.5.1 // indirect

src/rd-init/go.mod:3 declares go 1.25.0 and golang.org/x/sys v0.43.0 (recently bumped in 69c42c26d and 7bc2b6722). Same builder image, same repo, two different toolchain floors. Dependabot raises bumps per module, so the next x/sys advisory will need two PRs instead of one.

module github.com/rancher-sandbox/rancher-desktop-opensuse/src/rd-init

go 1.25.0

require (
	github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf
	github.com/coreos/go-systemd/v22 v22.7.0
	github.com/goccy/go-yaml v1.19.2

-go 1.23.0
+go 1.25.0
...
-	golang.org/x/sys v0.21.0 // indirect
+	golang.org/x/sys v0.43.0 // indirect

After bumping, run go mod tidy to refresh go.sum.

(suggestion, gap) — round 1 S4 unaddressed.