From 841100caa7d66232f33386016411a2a4fd3f44d0 Mon Sep 17 00:00:00 2001 From: rcourtman Date: Fri, 12 Jun 2026 09:57:58 +0100 Subject: [PATCH] Clarify Proxmox LXC Docker install path --- cmd/pulse-agent/main.go | 4 +-- cmd/pulse-agent/main_test.go | 4 +-- .../v6/internal/subsystems/agent-lifecycle.md | 8 ++++- .../v6/internal/subsystems/api-contracts.md | 10 ++++++ .../subsystems/deployment-installability.md | 10 ++++++ .../subsystems/frontend-primitives.md | 5 +++ .../internal/subsystems/security-privacy.md | 2 +- .../internal/subsystems/unified-resources.md | 5 +++ .../InfrastructureInstallerSection.tsx | 36 ++++++++++++++----- .../InfrastructureOperationsModel.test.tsx | 11 ++++-- .../infrastructureOperationsModel.tsx | 2 +- .../src/features/docker/DockerPageSurface.tsx | 2 +- .../__tests__/DockerPageSurface.test.tsx | 18 ++++++++++ scripts/install.sh | 12 +++++-- scripts/installtests/install_sh_test.go | 25 +++++++++++++ .../release_control/subsystem_lookup_test.py | 2 +- 16 files changed, 133 insertions(+), 23 deletions(-) diff --git a/cmd/pulse-agent/main.go b/cmd/pulse-agent/main.go index 9905c8b6c..cd2337a81 100644 --- a/cmd/pulse-agent/main.go +++ b/cmd/pulse-agent/main.go @@ -681,7 +681,7 @@ type Config struct { DockerRuntime string // Force Docker / Podman runtime: docker, podman, or auto // Security - EnableCommands bool // Enable command execution for Patrol remediation (disabled by default) + EnableCommands bool // Enable Pulse command execution for Patrol actions and Proxmox LXC Docker inventory (disabled by default) // Enrollment Enroll bool // Exchange bootstrap token for runtime token on startup @@ -813,7 +813,7 @@ func loadConfig(args []string, getenv func(string) string) (Config, error) { disableAutoUpdateFlag := fs.Bool("disable-auto-update", utils.ParseBool(envDisableAutoUpdate), "Disable automatic updates") disableDockerUpdateChecksFlag := fs.Bool("disable-docker-update-checks", utils.ParseBool(envDisableDockerUpdateChecks), "Disable Docker image update detection (avoids Docker Hub rate limits)") dockerRuntimeFlag := fs.String("docker-runtime", envDockerRuntime, "Docker / Podman runtime: auto, docker, or podman (default: auto)") - enableCommandsFlag := fs.Bool("enable-commands", utils.ParseBool(envEnableCommands), "Enable command execution for Patrol remediation (disabled by default)") + enableCommandsFlag := fs.Bool("enable-commands", utils.ParseBool(envEnableCommands), "Enable Pulse command execution for Patrol actions and Proxmox LXC Docker inventory (disabled by default)") disableCommandsFlag := fs.Bool("disable-commands", false, "[DEPRECATED] Commands are now disabled by default; use --enable-commands to enable") enrollFlag := fs.Bool("enroll", false, "Exchange bootstrap token for runtime token (used by deploy wizard)") healthAddrFlag := fs.String("health-addr", defaultHealthAddr, "Health/metrics server address (empty to disable)") diff --git a/cmd/pulse-agent/main_test.go b/cmd/pulse-agent/main_test.go index 63b8853c4..295adf71d 100644 --- a/cmd/pulse-agent/main_test.go +++ b/cmd/pulse-agent/main_test.go @@ -30,8 +30,8 @@ func TestEnableCommandsHelpUsesPatrolRemediationCopy(t *testing.T) { } text := string(source) - if !strings.Contains(text, "Enable command execution for Patrol remediation (disabled by default)") { - t.Fatal("expected enable-commands help to describe Patrol remediation") + if !strings.Contains(text, "Enable Pulse command execution for Patrol actions and Proxmox LXC Docker inventory (disabled by default)") { + t.Fatal("expected enable-commands help to describe Patrol actions and Proxmox LXC Docker inventory") } if strings.Contains(text, "Enable command execution for AI auto-fix") { t.Fatal("enable-commands help must not revive AI auto-fix wording") diff --git a/docs/release-control/v6/internal/subsystems/agent-lifecycle.md b/docs/release-control/v6/internal/subsystems/agent-lifecycle.md index 3b16d33cb..a4fbee6b7 100644 --- a/docs/release-control/v6/internal/subsystems/agent-lifecycle.md +++ b/docs/release-control/v6/internal/subsystems/agent-lifecycle.md @@ -779,7 +779,7 @@ profile and assignment columns, but embedded table framing must route through 7. Add or change the unified agent CLI entrypoint, version/help exit semantics, or startup argument/error routing through `cmd/pulse-agent/main.go`. The CLI entrypoint owns propagation of persistence context into runtime-owned helpers. When installer-selected state roots differ from the default, `cmd/pulse-agent/main.go` must pass that exact `StateDir` through both the host-agent runtime and updater startup paths instead of letting one path silently fall back to `/var/lib/pulse-agent`. The same runtime-owned boundary also owns Pulse control-plane URL validation for agent startup, remote config, updater continuity, and command transport. Non-loopback control-plane URLs remain HTTPS/WSS by default, but explicitly insecure agent/dev-runtime flows may use plain HTTP/WS for LAN development control planes; installer-persisted dev URLs must not be accepted by one runtime path and rejected by another. - The unified agent CLI copy follows the same Patrol remediation vocabulary as the install surface. `cmd/pulse-agent/main.go` may keep the `--enable-commands` flag name for compatibility, but the help text and inline comments must describe command execution as Patrol remediation rather than reviving AI auto-fix language. + The unified agent CLI copy follows the same command-execution vocabulary as the install surface. `cmd/pulse-agent/main.go` may keep the `--enable-commands` flag name for compatibility, but the help text and inline comments must describe command execution as Pulse command execution for Patrol actions and governed Proxmox LXC Docker inventory rather than reviving AI auto-fix language. The unified agent CLI copy also owns operator-facing Docker / Podman runtime labels. `cmd/pulse-agent/main.go` may keep the historical `--enable-docker` and `--docker-runtime` flag names for compatibility, but @@ -3061,6 +3061,12 @@ install copy may recommend installing the agent on every machine that needs temperatures, SMART disk data, services, Docker, or Kubernetes telemetry, but they may not imply that API-backed cluster visibility or best-effort peer augmentation is equivalent to a local agent install on that machine. +Docker onboarding copy must also distinguish the standalone Docker / Podman +install path from Docker inside Proxmox LXCs: standalone runtimes use the +Docker runtime profile on that host, while Proxmox LXC Docker inventory uses a +Proxmox VE node agent with command execution plus explicit server-side +`PULSE_ENABLE_PROXMOX_GUEST_DOCKER_INVENTORY=true`, and the copy may not imply +that installing an agent inside every LXC is required. That same connected-systems summary must preserve canonical local operator identity for newly connected infrastructure. When governed resources such as PBS or PMG appear in the setup-completion poll, the surface must show their diff --git a/docs/release-control/v6/internal/subsystems/api-contracts.md b/docs/release-control/v6/internal/subsystems/api-contracts.md index 774506940..982e8811e 100644 --- a/docs/release-control/v6/internal/subsystems/api-contracts.md +++ b/docs/release-control/v6/internal/subsystems/api-contracts.md @@ -378,6 +378,11 @@ payload shape change when the portal presents compact client rows. `frontend-modern/src/utils/sourcePlatforms.ts` rather than page-local wording, because those install choices set API-token and install-command expectations for the operator. + That same install-profile model must keep the standalone Docker / Podman + runtime profile distinct from Proxmox LXC Docker inventory. The Docker + profile may force local runtime monitoring, while Docker inside LXCs must + point operators to the Proxmox VE node profile plus command execution and + explicit server-side guest Docker inventory opt-in. That same browser/API boundary must not retain customer-side commercial or onboarding telemetry wrappers around infrastructure operations. Pulse Account and the server-owned commercial reporting routes own commercial @@ -1178,6 +1183,11 @@ the canonical monitored-system blocked payload. rewritten into source credential, liveness, or setup failure facts. That same governed infrastructure-operations API boundary also owns discovery polling activation: the shared discovery runtime may only poll `/api/discover` while the settings shell has the `infrastructure-connections` route active, so route-level IA changes cannot silently keep discovery traffic alive on unrelated systems or install screens. That same governed setup/install boundary also owns uninstall convergence: when a script-managed Proxmox node removes its local Pulse credentials, the canonical `/api/auto-unregister` API must remove the matching stored node immediately and emit the same discovery/node-deleted refresh semantics as manual deletion, so the infrastructure sources table does not keep a stale active row until the next failed poll. + That same governed install-presentation boundary must preserve the + Docker-versus-Proxmox LXC distinction from the shared model: generated + install surfaces may not imply that Docker inside Proxmox LXCs requires a + guest-local agent when the intended path is a Proxmox node agent with + command execution and server-side guest Docker inventory opt-in. That same governed setup/install boundary also owns Proxmox `authorized_keys` symlink preservation in the rendered PVE setup script: temperature-key install and uninstall edits must resolve the real diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md index 6e687513c..1d5c6db60 100644 --- a/docs/release-control/v6/internal/subsystems/deployment-installability.md +++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md @@ -271,6 +271,12 @@ TLS floor in the dynamic config. settings, insecure flag, and persisted agent id from the local installed agent state, must fail closed when no existing installation or connection state is present, and must refuse to silently become a new install command. + The shell installer must disclose `--enable-commands` as Pulse command + execution, disabled by default, and must name both Patrol actions and + Proxmox LXC Docker inventory as the operator-visible reasons to enable it. + When enabled, the terminal summary must also state that Proxmox LXC Docker + inventory still requires explicit server-side + `PULSE_ENABLE_PROXMOX_GUEST_DOCKER_INVENTORY=true`. ## Extension Points @@ -314,6 +320,10 @@ TLS floor in the dynamic config. installer in that slot silently breaks every one of those flows because the agent installer rejects `--version` as an unknown argument; this drift shipped across v6 rc.1 → rc.5 (April 12 → May 11, 2026) before being caught. + Installer-facing command-execution copy must remain aligned with the served + agent installer: Proxmox LXC Docker inventory may be described only as an + opt-in host-side path that requires both agent command execution and server + guest-Docker inventory opt-in. `scripts/validate-release.sh` must therefore fail the release if the published `install.sh` does not carry the server-installer banner, does not handle `--version)` in its argument parser, contains the agent installer diff --git a/docs/release-control/v6/internal/subsystems/frontend-primitives.md b/docs/release-control/v6/internal/subsystems/frontend-primitives.md index e360e392d..03a9e0ec6 100644 --- a/docs/release-control/v6/internal/subsystems/frontend-primitives.md +++ b/docs/release-control/v6/internal/subsystems/frontend-primitives.md @@ -269,6 +269,11 @@ bounds, current/desired replicas, and metric source columns. Kubernetes events inventory follows that same primitive boundary while the unified-resource owner supplies Event type, reason, involved-object, count, observed-time, and message columns. +Docker empty-state guidance on platform pages follows the same shared platform +primitive boundary: it may use the route-specific Docker / Podman vocabulary, +but it must distinguish standalone Docker host installation from the Proxmox +LXC Docker host-side inventory path without adding page-local installer command +assembly or token handling. Docker / Podman inventory follows that same primitive boundary while the unified-resource owner supplies API-object-specific container, image, volume, network, Swarm node, task, secret, and config columns through dedicated native diff --git a/docs/release-control/v6/internal/subsystems/security-privacy.md b/docs/release-control/v6/internal/subsystems/security-privacy.md index 91903fd85..afaa7e26d 100644 --- a/docs/release-control/v6/internal/subsystems/security-privacy.md +++ b/docs/release-control/v6/internal/subsystems/security-privacy.md @@ -157,7 +157,7 @@ controls as normal product settings. auth-env reloads, hosted entitlement refresh origins, and pinned-fingerprint TLS clients keep one fail-closed security floor. 9. Change operator-facing Resource Privacy/Data Handling posture through `frontend-modern/src/components/Settings/DataHandlingPanel.tsx` and `frontend-modern/src/components/Settings/dataHandlingPanelModel.ts` together so resource classification, handling-boundary, redaction copy, and the route-backed/hidden-sidebar presentation stay governed as a trust surface. -10. Change inside-guest runtime collection boundaries through `docs/AGENT_SECURITY.md`, `docs/UNIFIED_AGENT.md`, `cmd/pulse-agent/main.go`, `internal/api/router.go`, and `internal/config/config.go` together. Docker / Podman inventory inside a VM or LXC may come from a guest-local `pulse-agent` module or explicitly reported guest data; LXC Docker inventory may also be collected by a Proxmox host agent only through explicit server opt-in, with optional VMID allowlisting and a minimal summary command set that avoids `docker inspect`, environment, mount, file, command, and process collection. Local Unified Agent Docker / Podman disables must not be reversed by remote profile configuration, and self-test/update preflight that needs the live runtime token must pass it through a short-lived token file rather than argv. The `--enable-docker` help line is part of that operator privacy control, so it must remain "Enable Docker / Podman Agent module" instead of exposing internal collection-module wording. +10. Change inside-guest runtime collection boundaries through `docs/AGENT_SECURITY.md`, `docs/UNIFIED_AGENT.md`, `cmd/pulse-agent/main.go`, `internal/api/router.go`, and `internal/config/config.go` together. Docker / Podman inventory inside a VM or LXC may come from a guest-local `pulse-agent` module or explicitly reported guest data; LXC Docker inventory may also be collected by a Proxmox host agent only through explicit server opt-in, with optional VMID allowlisting and a minimal summary command set that avoids `docker inspect`, environment, mount, file, command, and process collection. Local Unified Agent Docker / Podman disables must not be reversed by remote profile configuration, and self-test/update preflight that needs the live runtime token must pass it through a short-lived token file rather than argv. The `--enable-docker` help line is part of that operator privacy control, so it must remain "Enable Docker / Podman Agent module" instead of exposing internal collection-module wording. The `--enable-commands` help line and installer disclosure must identify Pulse command execution as disabled by default and required for Patrol actions or the explicit Proxmox LXC Docker inventory path, not as implicit guest access. Global resource timeline reads through `/api/resources/timeline` are adjacent monitoring-read surfaces, not a privacy bypass. Provider activity filters may expose backend-authored task/event metadata, but the endpoint diff --git a/docs/release-control/v6/internal/subsystems/unified-resources.md b/docs/release-control/v6/internal/subsystems/unified-resources.md index 65820e7ae..0a7826e2e 100644 --- a/docs/release-control/v6/internal/subsystems/unified-resources.md +++ b/docs/release-control/v6/internal/subsystems/unified-resources.md @@ -170,6 +170,11 @@ evidence, and inactive standalone Swarm metadata must not be interpreted as host-role or service-surface proof. The unified-resource adapter is the backend fail-closed layer for that rule, so persisted or older-agent inactive Swarm payloads cannot reintroduce false Swarm capability surfaces. +The empty state for this route must preserve that runtime-lens contract: +standalone Docker / Podman hosts use a local runtime agent, while Docker inside +Proxmox LXCs is represented as the explicitly opted-in Proxmox host-side guest +Docker inventory path rather than a requirement to install an agent in every +guest. Platform Overview tabs are rollup boundaries, not duplicate inventory dumps. Docker / Podman Overview owns runtime host rows and primary container workload diff --git a/frontend-modern/src/components/Settings/InfrastructureInstallerSection.tsx b/frontend-modern/src/components/Settings/InfrastructureInstallerSection.tsx index c73060e79..661eebdf3 100644 --- a/frontend-modern/src/components/Settings/InfrastructureInstallerSection.tsx +++ b/frontend-modern/src/components/Settings/InfrastructureInstallerSection.tsx @@ -79,12 +79,12 @@ const INSTALLER_FOCUS_PRESENTATION: Record< platforms: ['linux'], }, docker: { - title: 'Install on the Docker host', + title: 'Install for Docker / Podman', description: - 'Run the installer on the machine that runs Docker or Podman so Pulse can discover containers from that host.', + 'Run on the machine that runs Docker or Podman. For Docker inside Proxmox LXCs, use the Proxmox node path below instead of installing inside every guest.', recommendationTitle: 'Docker install path', recommendationDetail: - 'Install Pulse Agent on the Docker or Podman host. The Docker profile is selected for this flow so copied commands force container monitoring when automatic detection is restricted.', + 'For a standalone Docker or Podman host, install Pulse Agent on that host. The Docker profile is selected for this flow so copied commands force runtime monitoring when automatic detection is restricted. For Docker inside Proxmox LXCs, install on the Proxmox node, select the Proxmox VE node profile, and enable command execution so the server-opted-in LXC inventory path can run.', preferredProfile: 'docker', platforms: ['linux'], }, @@ -106,7 +106,7 @@ const getCommandSectionTitle = ( ): string => { if (section.platform !== 'linux') return section.title; if (focus === 'unraid') return 'Run on Unraid'; - if (focus === 'docker') return 'Run on the Docker host'; + if (focus === 'docker') return 'Run on the Docker host or Proxmox node'; if (focus === 'kubernetes') return 'Run on a Kubernetes node'; return section.title; }; @@ -120,7 +120,7 @@ const getCommandSectionDescription = ( return 'Use the Linux installer from Unraid terminal or SSH. The agent stores its local uninstall helper under the Unraid plugin path.'; } if (focus === 'docker') { - return 'Use the Linux installer on the Docker or Podman host. Commands in this flow include the Docker profile.'; + return 'Use the Linux installer on a standalone Docker or Podman host. For Docker inside Proxmox LXCs, switch Target profile to Proxmox VE node and enable command execution.'; } if (focus === 'kubernetes') { return 'Use the Linux installer on a Kubernetes node. Commands in this flow include the Kubernetes profile.'; @@ -254,6 +254,22 @@ export const InfrastructureInstallerSection: Component + +
+

Docker inside Proxmox LXCs

+

+ Install the agent on the Proxmox node, not inside every LXC. In advanced options, + select Proxmox VE node and enable{' '} + Pulse command execution. Then start Pulse with{' '} + PULSE_ENABLE_PROXMOX_GUEST_DOCKER_INVENTORY=true; optionally restrict it + with PULSE_PROXMOX_GUEST_DOCKER_INVENTORY_VMIDS=101,102. Pulse uses + bounded pct exec inventory for docker ps and{' '} + docker stats, skips guests that already have their own agent, and does + not collect inspect, environment, mount, command, or process details. +

+
+ +

@@ -545,7 +561,7 @@ export const InfrastructureInstallerSection: Component state.setEnableCommands(event.currentTarget.checked)} class="rounded text-blue-600 focus:ring-blue-500" /> - Enable Pulse command execution (for Patrol remediation) + Enable Pulse command execution (Patrol actions and Proxmox LXC Docker inventory)

- Pulse commands enabled — The agent will - accept diagnostic and fix commands from Pulse Patrol features. + Pulse commands enabled: The agent will accept + Pulse-scoped command requests. On Proxmox nodes, this is required for opted-in + Docker-in-LXC inventory because Pulse runs bounded pct exec{' '} + Docker summary checks.
diff --git a/frontend-modern/src/components/Settings/__tests__/InfrastructureOperationsModel.test.tsx b/frontend-modern/src/components/Settings/__tests__/InfrastructureOperationsModel.test.tsx index 4dd7f9226..9e7d250bf 100644 --- a/frontend-modern/src/components/Settings/__tests__/InfrastructureOperationsModel.test.tsx +++ b/frontend-modern/src/components/Settings/__tests__/InfrastructureOperationsModel.test.tsx @@ -230,7 +230,12 @@ describe('infrastructure operations model', () => { ); expect(infrastructureInstallerSectionSource).toContain('Install on Unraid'); expect(infrastructureInstallerSectionSource).toContain('Run on Unraid'); - expect(infrastructureInstallerSectionSource).toContain('Install on the Docker host'); + expect(infrastructureInstallerSectionSource).toContain('Install for Docker / Podman'); + expect(infrastructureInstallerSectionSource).toContain('Docker inside Proxmox LXCs'); + expect(infrastructureInstallerSectionSource).toContain( + 'PULSE_ENABLE_PROXMOX_GUEST_DOCKER_INVENTORY=true', + ); + expect(infrastructureInstallerSectionSource).toContain('bounded pct exec'); expect(infrastructureInstallerSectionSource).toContain('Install on a Kubernetes node'); expect(infrastructureInstallerSectionSource).toContain( 'state.handleInstallProfileChange(presentation().preferredProfile)', @@ -263,10 +268,10 @@ describe('infrastructure operations model', () => { 'Generate an install token first. Pulse will then build copy-ready commands', ); expect(infrastructureInstallerSectionSource).toContain( - 'Allow Pulse Patrol to execute diagnostic and fix commands on this agent', + 'Allow Pulse-scoped command requests on this agent for Patrol actions and opted-in Proxmox LXC Docker inventory', ); expect(infrastructureInstallerSectionSource).toContain( - 'Enable Pulse command execution (for Patrol remediation)', + 'Enable Pulse command execution (Patrol actions and Proxmox LXC Docker inventory)', ); expect(infrastructureInstallerSectionSource).not.toContain('Patrol auto-fix'); expect(infrastructureInstallerSectionSource).not.toContain('auto-fix requires Pulse Pro'); diff --git a/frontend-modern/src/components/Settings/infrastructureOperationsModel.tsx b/frontend-modern/src/components/Settings/infrastructureOperationsModel.tsx index 192117e70..51df994c6 100644 --- a/frontend-modern/src/components/Settings/infrastructureOperationsModel.tsx +++ b/frontend-modern/src/components/Settings/infrastructureOperationsModel.tsx @@ -317,7 +317,7 @@ export const INSTALL_PROFILE_OPTIONS: InstallProfileOption[] = [ value: 'proxmox-pve', label: 'Proxmox VE node', description: - 'Force Proxmox integration and register as a PVE node. Install on each cluster member when you want full node-local telemetry such as temperatures and SMART data.', + 'Force Proxmox integration and register as a PVE node. Install on each cluster member for node-local telemetry such as temperatures and SMART data; use this profile plus command execution when Docker inside LXCs should be inventoried from the Proxmox host path.', flags: ['--enable-proxmox', '--proxmox-type pve'], }, { diff --git a/frontend-modern/src/features/docker/DockerPageSurface.tsx b/frontend-modern/src/features/docker/DockerPageSurface.tsx index 3105f0338..ce2cfb267 100644 --- a/frontend-modern/src/features/docker/DockerPageSurface.tsx +++ b/frontend-modern/src/features/docker/DockerPageSurface.tsx @@ -110,7 +110,7 @@ export function DockerPageSurface() { } > diff --git a/frontend-modern/src/features/docker/__tests__/DockerPageSurface.test.tsx b/frontend-modern/src/features/docker/__tests__/DockerPageSurface.test.tsx index 36ab1aa0e..3d52a593f 100644 --- a/frontend-modern/src/features/docker/__tests__/DockerPageSurface.test.tsx +++ b/frontend-modern/src/features/docker/__tests__/DockerPageSurface.test.tsx @@ -227,6 +227,24 @@ afterEach(() => { }); describe('DockerPageSurface', () => { + it('explains the direct host and Proxmox LXC Docker install paths when empty', () => { + mocks.useUnifiedResources.mockReturnValue({ + error: () => null, + loading: () => false, + refetch: vi.fn(), + resources: () => [], + }); + + render(() => ); + + const emptyState = screen.getByTestId('platform-table-empty-state'); + expect(emptyState).toHaveAttribute('data-title', 'No Docker or Podman hosts'); + expect(emptyState).toHaveTextContent('Install the Pulse agent on a Docker or Podman host'); + expect(emptyState).toHaveTextContent('Docker inside Proxmox LXCs'); + expect(emptyState).toHaveTextContent('command execution enabled'); + expect(emptyState).toHaveTextContent('Proxmox guest Docker inventory'); + }); + it('keeps overview focused on runtime hosts plus primary container workloads', () => { render(() => ); diff --git a/scripts/install.sh b/scripts/install.sh index f79943e6f..b326284cb 100755 --- a/scripts/install.sh +++ b/scripts/install.sh @@ -22,7 +22,7 @@ # --agent-id Custom agent identifier (default: auto-generated) # --disk-exclude Exclude mount points matching pattern (repeatable) # --insecure Skip TLS certificate verification -# --enable-commands Enable AI command execution on agent (disabled by default) +# --enable-commands Enable Pulse command execution on agent (disabled by default; required for Patrol actions and Proxmox LXC Docker inventory) # --health-addr Health/metrics listener address (default: 127.0.0.1:9191, use "" to disable) # --update Update an existing agent using saved connection state # --uninstall Remove the agent @@ -299,7 +299,7 @@ Options: --disk-exclude Exclude mount point (repeatable) --insecure Skip TLS verification (auto-enabled for http:// URLs) --cacert Custom CA certificate for TLS (used by curl and agent) - --enable-commands Enable AI command execution + --enable-commands Enable Pulse command execution (disabled by default; required for Patrol actions and Proxmox LXC Docker inventory) --health-addr Health/metrics listener address (default: 127.0.0.1:9191; use "" to disable) --enroll Exchange bootstrap token for runtime token (deploy wizard) --update Update an existing agent using saved connection state @@ -1797,6 +1797,7 @@ log_info " Agent metrics: $ENABLE_HOST" log_info " Docker/Podman: $ENABLE_DOCKER" log_info " Kubernetes: $ENABLE_KUBERNETES" log_info " Proxmox: $ENABLE_PROXMOX" +log_info " Pulse command execution: $ENABLE_COMMANDS" if [[ "$ENABLE_PROXMOX" == "true" ]]; then if [[ -n "$PROXMOX_TYPE" ]]; then log_info " Proxmox type: $PROXMOX_TYPE" @@ -1804,6 +1805,13 @@ if [[ "$ENABLE_PROXMOX" == "true" ]]; then log_info " Proxmox type: auto-detect all installed services" fi fi +if [[ "$ENABLE_COMMANDS" == "true" ]]; then + log_info " Accepts Pulse-scoped command requests on this agent." + log_info " On Proxmox nodes this is required for opted-in LXC Docker inventory via pct exec." + log_info " The Pulse server must also be started with PULSE_ENABLE_PROXMOX_GUEST_DOCKER_INVENTORY=true." +else + log_info " Command execution is off; enable only when Patrol actions or Proxmox LXC Docker inventory are needed." +fi if [[ "$ENABLE_DOCKER" == "true" ]] && discover_rootless_container_runtime; then if [[ "$ROOTLESS_RUNTIME_KIND" == "docker" ]]; then diff --git a/scripts/installtests/install_sh_test.go b/scripts/installtests/install_sh_test.go index 32abdc000..c6b702461 100644 --- a/scripts/installtests/install_sh_test.go +++ b/scripts/installtests/install_sh_test.go @@ -71,6 +71,31 @@ func TestInstallSHAutoDetectProxmoxKeepsRuntimeTypeUnpinned(t *testing.T) { } } +func TestInstallSHExplainsCommandExecutionForProxmoxLXCDockerInventory(t *testing.T) { + content, err := os.ReadFile(repoFile("scripts", "install.sh")) + if err != nil { + t.Fatalf("read install.sh: %v", err) + } + + script := string(content) + required := []string{ + `--enable-commands Enable Pulse command execution (disabled by default; required for Patrol actions and Proxmox LXC Docker inventory)`, + `log_info " Pulse command execution: $ENABLE_COMMANDS"`, + `log_info " Accepts Pulse-scoped command requests on this agent."`, + `log_info " On Proxmox nodes this is required for opted-in LXC Docker inventory via pct exec."`, + `log_info " The Pulse server must also be started with PULSE_ENABLE_PROXMOX_GUEST_DOCKER_INVENTORY=true."`, + `log_info " Command execution is off; enable only when Patrol actions or Proxmox LXC Docker inventory are needed."`, + } + for _, needle := range required { + if !strings.Contains(script, needle) { + t.Fatalf("install.sh missing command-execution disclosure: %s", needle) + } + } + if strings.Contains(script, "Enable AI command execution") { + t.Fatal("install.sh must not describe --enable-commands as AI command execution") + } +} + func TestInstallSHAcceptsLegacyBooleanFlagValues(t *testing.T) { content, err := os.ReadFile(repoFile("scripts", "install.sh")) if err != nil { diff --git a/scripts/release_control/subsystem_lookup_test.py b/scripts/release_control/subsystem_lookup_test.py index bb950b7e7..23529ae32 100644 --- a/scripts/release_control/subsystem_lookup_test.py +++ b/scripts/release_control/subsystem_lookup_test.py @@ -2860,7 +2860,7 @@ class SubsystemLookupTest(unittest.TestCase): { "heading": "## Shared Boundaries", "path": "internal/api/access_control_handlers.go", - "line": 452, + "line": 457, "heading_line": 119, } ],