VM can't contact GitHub in IPv6 only environments

[SchoolGuy]

Bug Report

Description

When hosting Fireactions in an IPv6 only environment, operation is not possible because the VM has no IPv6 address assigned and no IPv4 network is available.

Expected Behavior

The VM can contact GitHub.

Current Behavior

Logs from the runner VM

Oct 17 00:21:43 localhost.localdomain systemd[1]: Started Fireactions.
Oct 17 00:21:43 localhost.localdomain fireactions[850]: 2025-10-17 00:21:43 INF runner.go:113 > Starting GitHub runner
Oct 17 00:21:43 localhost.localdomain fireactions[850]: 2025-10-17 00:21:43 INF runner.go:114 > Running command: /opt/runner/run.sh
Oct 17 00:41:05 localhost.localdomain fireactions[903]: 2025-10-17 00:41:05Z: Runner connect error: Resource temporarily unavailable (pipelinesghubeus22.actions.githubusercontent.com:443). Retrying until reconnected.

IP address:

root@localhost:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 2e:1e:e0:2c:02:74 brd ff:ff:ff:ff:ff:ff
    inet 192.168.128.2/24 brd 192.168.128.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::2c1e:e0ff:fe2c:274/64 scope link 
       valid_lft forever preferred_lft forever
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default 
    link/ether 72:ab:ed:b8:b9:22 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever

Possible Solution

None available atm

Steps to Reproduce (for bugs)

1. Use Ansible Playbook to install
2. Minor tweaks not covered by the Ansible Playbook (downloading kernel and setting up the lvm thin pool)
3. Starting the fireactions systemd service
4. Login to a VM

Your Environment

• Fireactions version: 0.3.0
• OS: openSUSE Leap 15.6

[SchoolGuy]

View of the network from the host (I masked the public IP a bit):

root@apollo (Cobbler GitHub Runner, K3S):~ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute 
       valid_lft forever preferred_lft forever
2: usb0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether d2:21:1f:bd:19:d7 brd ff:ff:ff:ff:ff:ff
    altname enp10s0u9u3c2
3: ob0: <BROADCAST,MULTICAST,SLAVE,UP,LOWER_UP> mtu 1500 qdisc mq master bond-ob state UP group default qlen 1000
    link/ether 9c:6b:00:5a:9f:cb brd ff:ff:ff:ff:ff:ff
    altname enp4s0
4: ob1: <BROADCAST,MULTICAST,SLAVE,UP,LOWER_UP> mtu 1500 qdisc mq master bond-ob state UP group default qlen 1000
    link/ether 9c:6b:00:5a:9f:cb brd ff:ff:ff:ff:ff:ff permaddr 9c:6b:00:5a:a5:8e
    altname enp5s0
5: bond-ob: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 9c:6b:00:5a:9f:cb brd ff:ff:ff:ff:ff:ff
    inet6 fe80::9e6b:ff:fe5a:9fcb/64 scope link proto kernel_ll 
       valid_lft forever preferred_lft forever
6: os-ghr-c@bond-ob: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 9c:6b:00:5a:9f:cb brd ff:ff:ff:ff:ff:ff
    inet6 2a07:de40:aaaa:aaaa::a/64 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::9e6b:ff:fe5a:9fcb/64 scope link proto kernel_ll 
       valid_lft forever preferred_lft forever
7: fireactions-br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 02:ea:5e:61:d6:f3 brd ff:ff:ff:ff:ff:ff
    inet 192.168.128.1/24 brd 192.168.128.255 scope global fireactions-br0
       valid_lft forever preferred_lft forever
    inet6 fe80::ea:5eff:fe61:d6f3/64 scope link proto kernel_ll 
       valid_lft forever preferred_lft forever
8: veth87f51fc0@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master fireactions-br0 state UP group default 
    link/ether 06:af:df:c3:f4:c5 brd ff:ff:ff:ff:ff:ff link-netns fireactions-runner-d5db7f01676f989617241fb3
    inet6 fe80::4af:dfff:fec3:f4c5/64 scope link proto kernel_ll 
       valid_lft forever preferred_lft forever
root@apollo (Cobbler GitHub Runner, K3S):~ # ip r
192.168.128.0/24 dev fireactions-br0 proto kernel scope link src 192.168.128.1 
root@apollo (Cobbler GitHub Runner, K3S):~ # ip -6 r
2a07:de40:aaaa:aaaa::/64 dev os-ghr-c proto kernel metric 256 pref medium
fe80::/64 dev bond-ob proto kernel metric 256 pref medium
fe80::/64 dev os-ghr-c proto kernel metric 256 pref medium
fe80::/64 dev fireactions-br0 proto kernel metric 256 pref medium
fe80::/64 dev veth87f51fc0 proto kernel metric 256 pref medium
default via 2a07:de40:aaaa:aaaa::3 dev os-ghr-c metric 1024 pref medium

[SchoolGuy]

My understanding is that one needs to adjust the CNI configuration to achieve this. I will research how to do this.

[SchoolGuy]

Switching to a Dual-Stack configuration like the following results in an issue with the Golang Code:

{
  "cniVersion": "0.4.0",
  "name": "fireactions",
  "plugins": [
    {
      "bridge": "fireactions-br0",
      "forceAddress": false,
      "hairpinMode": true,
      "ipMasq": true,
      "ipam": {
        "dataDir": "/var/run/cni",
        "resolvConf": "/etc/resolv.conf",
        "type": "host-local",
        "ranges": [
          [
            {
              "subnet": "192.168.128.0/24",
              "gateway": "192.168.128.1"
            }
          ],
          [
            {
              "subnet": "fd00:cafe:beef::/64",
              "gateway": "fd00:cafe:beef::1"
            }
          ]
        ]
      },
      "isDefaultGateway": true,
      "mtu": 1500,
      "type": "bridge"
    },
    {
      "type": "firewall"
    },
    {
      "type": "tc-redirect-tap"
    }
  ]
}

Issue:

Oct 17 07:37:46 apollo fireactions[22982]: 2025-10-17 07:37:46 ERR pool.go:125 > Failed to scale pool error="firecracker: starting machine: failed to parse VM network configuration from CNI output, ensure CNI is configured with a plugin that supports automatic VM network configuration such as tc-redirect-tap: expected to find 1 IP for vm interface \"tap0\", but instead found [{Interface:0xc000b09288 Address:{IP:192.168.128.104 Mask:ffffff00} Gateway:192.168.128.1} {Interface:0xc000b092d0 Address:{IP:fd00:cafe:beef::67 Mask:ffffffffffffffff0000000000000000} Gateway:fd00:cafe:beef::1}]" pool=fireactions-performance

[SchoolGuy]

It seems the mdns service is hardcoded in Golang to an IPv4 IP atm:

fireactions/runner/mmds/client.go

Line 19 in 330b0df

defaultMMDSAddress = "http://169.254.169.254"

So to get everything IPv6 ready, more effort is needed...

[tacerus]

One issue I find is that with an IPv6 subnet in the CNI configuration, the ip parameter in the VM kernel cmdline is not populated correctly - according to the Dracut manual, the IPv6 addresses need to be wrapped with square brackets. Unfortunately I cannot find where in the firecracker source code the ip parameter is added/constructed.