Walkthrough

Adds a sandbox-side Docker-network reachability probe for the Ollama auth proxy, formats remediation guidance, and integrates a persistence+probe step into the ollama-local onboarding path that exits only on TCP connectivity failure.

Changes

Ollama Proxy Sandbox Reachability Check

Sequence Diagram(s)

sequenceDiagram
  participant Wizard as NemoClaw Wizard
  participant Probe as probeOllamaProxySandboxReachability
  participant Docker as Docker API
  participant Container as Busybox+nc container
  participant Proxy as Ollama auth proxy
  Wizard->>Probe: call probeOllamaProxySandboxReachability()
  Probe->>Docker: inspect network IPAM
  Docker-->>Probe: return subnet & gateway IP
  Probe->>Docker: run busybox container with --add-host mapping and nc -zw
  Docker->>Container: start container
  Container->>Proxy: TCP connect to host:11435
  Proxy-->>Container: accept or refuse connection
  Container-->>Docker: exit code + stderr
  Docker-->>Probe: probe result
  Probe->>Probe: classify as ok / tcp_failed / probe_unavailable
  Probe-->>Wizard: reachability result

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Suggested labels

fix, Provider: Ollama, Docker, Platform: Brev, Platform: Ubuntu, Sandbox, NemoClaw CLI, v0.0.40

Suggested reviewers

• ericksoa
• jyaunches

Poem

🐰 I sniff the Docker bridge at dawn and try a tiny probe,
Busybox hops in, netcat taps, across the network road.
If UFW guards the gate too tight and TCP gets denied,
I'll print the rule you need to run—no more the silent ride.
A small hop, a hopeful cheer, onboarding now checks inside.

❌ Failed checks (1 warning)

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Pi Semantic E2E Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

• gpu-e2e (high): Full onboard with NEMOCLAW_PROVIDER=ollama exercises the modified setupInference() ollama-local branch end-to-end. The new persistAndProbeOllamaProxy() call runs a real sandbox-network probe; a regression there would break local-Ollama onboard on every GPU host. Closest existing coverage of the user flow this PR touches.
• gpu-double-onboard-e2e (high): Coverage guard for ollama proxy token diverges from stored token after re-onboard, causing persistent HTTP 401 on inference #2553 (Ollama proxy token consistency across re-onboard). The PR replaces persistProxyToken() with persistAndProbeOllamaProxy() at the exact call site this test was designed to protect; re-onboard now triggers the probe twice and must remain idempotent without leaving stale token/PID state.
• onboard-resume-e2e (medium): PR docstring on persistAndProbeOllamaProxy explicitly states --resume re-enters setupInference and re-probes. Resume semantics depend on isInferenceRouteReady() staying false on probe failure so the next attempt re-runs setupInference; this test is the only existing coverage of resume re-entry.

Optional E2E

• test-e2e-ollama-proxy (low): Already auto-runs on this PR via pr.yaml when code changes. Validates the host-side auth proxy with a mock Ollama backend; it does not exercise the new sandbox-network probe but is cheap insurance that the proxy lifecycle still works after the persistAndProbeOllamaProxy() refactor.
• ollama-proxy-e2e (low): Workflow_dispatch host-side proxy validation: token persistence, recovery from kill, and container reachability check against the proxy. Useful confidence check that token persistence still happens before any probe-induced exit.

New E2E recommendations

• sandbox-networking (high): No existing E2E exercises the tcp_failed → process.exit(1) + UFW remediation path that motivates this PR (issue [Brev][Inference] Ollama inference hangs because Brev UFW blocks port 11435 from sandbox #3340, Brev/UFW-default-deny). All current tests run with permissive firewalls, so a regression that turns the probe into a false-negative (silently passing) or a false-positive (aborting clean onboards) would not be caught. Suggest a regression-e2e job that installs UFW with default-deny on the openshell-docker bridge subnet, runs nemoclaw onboard --provider ollama-local, asserts non-zero exit and that the printed message contains the expected sudo ufw allow ... port 11435 proto tcp remediation; then opens the rule and asserts a clean retry succeeds.
  • Suggested test: regression-e2e: ollama-proxy-sandbox-reachability-ufw — Linux runner with UFW default-deny; assert tcp_failed exit 1 + remediation text, then allow rule + retry succeeds.
• sandbox-networking (medium): The probe_unavailable classification on Docker Desktop / macOS / hosts without the openshell-docker network is critical to avoid blocking onboard on those platforms. macos-e2e.yaml exists; consider asserting that the probe returns probe_unavailable (non-fatal) on Docker Desktop and onboard continues past the ollama-local branch without exit 1.
  • Suggested test: macos-e2e: assert ollama-local onboard does not abort on Docker Desktop when the sandbox-network probe is unavailable.

Dispatch hint

• Workflow: nightly-e2e.yaml
• jobs input: gpu-e2e,gpu-double-onboard-e2e,onboard-resume-e2e