Summary
In Issue #72, we implemented a workaround by switching to the ssh binary for readiness probes. While this unblocks CI, it does not resolve the root cause: Go processes running under launchd (via Homebrew services) cannot directly route TCP traffic to the Tart bridge interface (bridge101).
This is a "bypass" rather than a fix. Any future features requiring direct TCP/Socket communication from the runner to the VM will still fail.
Observed Behavior
- Interactive Shell:
net.Dialer in Go can reach the VM IP (e.g., 192.168.64.x) perfectly.
- launchd Service: The same code fails with
connect: no route to host.
- Note: The
ssh command-line tool works in both contexts, which suggests ssh might have different entitlement or bypasses that raw Go sockets do not have under launchd.
Investigation / Tasks Needed
We need to identify the specific macOS security/network policy causing this isolation:
- TCC/Permissions: Does the daemon need specific "Local Network" or "Full Disk Access" entitlements in the
.plist?
- Sandbox Restrictions: Does
launchd apply a default sandbox profile that restricts access to bridge interfaces?
- Documentation: Once identified, we should update the installation guide to include the mandatory system-level permission grants (e.g., using
tccutil or modifying the service .plist).
Relates to
Summary
In Issue #72, we implemented a workaround by switching to the
sshbinary for readiness probes. While this unblocks CI, it does not resolve the root cause: Go processes running underlaunchd(via Homebrew services) cannot directly route TCP traffic to the Tart bridge interface (bridge101).This is a "bypass" rather than a fix. Any future features requiring direct TCP/Socket communication from the runner to the VM will still fail.
Observed Behavior
net.Dialerin Go can reach the VM IP (e.g.,192.168.64.x) perfectly.connect: no route to host.sshcommand-line tool works in both contexts, which suggestssshmight have different entitlement or bypasses that raw Go sockets do not have underlaunchd.Investigation / Tasks Needed
We need to identify the specific macOS security/network policy causing this isolation:
.plist?launchdapply a default sandbox profile that restricts access to bridge interfaces?tccutilor modifying the service.plist).Relates to