[matthewgrossman]

Summary

Prepares the tmachine runner environments for porting e2e/rust tests to the testkit suites: host.openshell.internal resolves on k3s, every environment has the Python workload image. A new host-gateway feature suite proves the first two on every runner row.

Related Issue

Closes #5275

Changes

• k3s host gateway. The k3s installers read the node's IPv4 InternalIP and set the chart's server.hostGatewayIP to it. Tests run on the node, so host.openshell.internal now resolves on k3s and k3s-ha. The HA overlay merges over the base values, so it inherits the setting.
• Python workload image. Every installer (deb, rpm, binaries, k3s, k3s-ha) now loads openshell/e2e-python:dev, along with the runtime images. Tests get it from the new testkit::python_image(), which OPENSHELL_TEST_PYTHON_IMAGE overrides. base_image() still defaults to nvcr.io/nvidia/base/ubuntu:24.04.
• host-gateway feature suite. The test serves HTTP on the host. It starts a sandbox from the Python image, then uses sandbox exec to run the image's system python3 (standard library only), which requests the page through host.openshell.internal. The default policy denies all network access, so the test passes one that names only the host and port, as the docs describe, and lets /usr/bin/python3.* connect. New rows run it on Docker rootful, Podman rootful and rootless, k3s, and k3s-ha.
  • The client doesn't run as the main process because of a k3s-ha race. When a short main process finishes before the CLI attaches, the attach can reach a replica that doesn't hold the sandbox's session. That replica answers "sandbox is not ready", because sandbox_relay_reachable only checks sessions on its own replica.
• Overlap with e2e/rust. The new test covers the same contract as host_gateway_alias::sandbox_reaches_host_openshell_internal_via_host_gateway_alias and the first check in podman_host_gateway. Both old tests stay until test(e2e): decide which e2e/rust tests to port and in what order #5297 decides their port. podman_host_gateway stays because it also checks the policy-DNS relay and that the alias survives sandbox stop and sandbox start, which the new test doesn't. The k3s-ha workaround above should be revisited when fix(server): consistent sandbox access after the main process exits #4950 lands (tracked in feat: consistent sandbox access after the main process exits #4949).
• Runner nextest settings (family config, --test-threads) were part of this PR and moved to test(runner): apply per-family nextest config and a thread count to runner rows #5295, since no suite uses them yet.
• TESTING.md documents the new suite.

Testing

• cargo fmt --check, cargo clippy -D warnings, and nextest pass for tests/testkit and tests/suites/features.
• nix build .#tmachine-config succeeds. On macOS the VM rows can't run locally, so CI validates them.
• Ran the Python client script against a local server: it succeeds, and it retries, then fails, against a closed port.
• E2E tests added (features/host-gateway)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

Label test:e2e applied, but pull-request/5277 does not exist yet. A maintainer needs to comment /ok to test 061ae1ee9a155984d381f66f28a166da70b8977c to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

[matthewgrossman]

/ok to test 061ae1e

[matthewgrossman]

/ok to test 64c4a0d

[elezar]

Approving. The host-gateway suite passed on all five rows (Docker rootful, Podman rootful and rootless, k3s, k3s-ha). Follow-ups: switch the client to the main process once #4950 lands, and record the podman_host_gateway stop/start and resolver checks in #5297 (done).