app

Adom Hydrogen

Public Made by Adom

by adom

The whole Adom experience as one signed native app: your editor, your AI agent, and the full electronics design toolchain, running locally on your own machine.

Overview Files Skills Discover Packages Releases Dependencies Issues20 Breadcrumbs Pull Requests Activity
Closed general

Workspace reports healthy with no internet: a full-tunnel WireGuard VPN under mirrored networking takes the whole container offline silently

John Lauer · 1mo ago ·closed by John Lauer

AdomLapper, 2026-09-11 16:53 to 17:20 UTC. The laptop woke from a 4-minute sleep with a full-tunnel WireGuard VPN connected (adapter UID-VPN-46, 192.168.12.9/32, DNS 192.168.12.1, routes 0.0.0.0/1 and 128.0.0.0/1 on the tunnel, 0.0.0.0/0 on Wi-Fi). WSL mirrored networking copied those routes onto the tunnel's mirror interface (eth4 inside the distro, same 192.168.12.9). A mirrored WireGuard interface cannot carry traffic from inside the VM, so from the workspace: DNS fails (resolver 10.255.255.254 via DNS tunneling), TCP to 1.1.1.1:443 and 172.67.144.47:443 both blocked, curl with DNS bypassed times out. Windows itself resolves and reaches HTTPS. Every AI thread in the container, package updates and the wiki were offline for the whole window.

Hydrogen said "Workspace healthy: code-server is serving on :7380 and reachable from the Windows host" throughout, because /container-status and wake-heal only test loopback.

Two things:

  1. Health: add an outbound probe to the workspace health poll (a 3 s HTTPS HEAD to wiki.adom.inc from inside the distro, or a DNS lookup plus a TCP connect), and a distinct state "workspace has no internet" in the narrative, the header meter and the Doctor. Never call a container healthy that cannot reach the wiki.
  2. Diagnosis: when that probe fails, read the host routes; if 0.0.0.0/1 or 128.0.0.0/1 point at a non-Wi-Fi adapter (WireGuard, OpenVPN TAP, Cisco), say so by name: "Your workspace cannot reach the internet: the VPN UID-VPN-46 owns the default routes and WSL cannot use it. Disconnect it or make it split-tunnel." Same shape as the WSL_WEDGED banner. Ray and Drew on corporate VPNs will hit exactly this.

Not a Hydrogen bug in the networking itself (a known limitation of mirrored mode with userspace tunnels), but Hydrogen must not stay quiet about it.

1 Reply

John Lauer · 1mo ago

Closing without a change, John's call: connectivity is Windows' and the laptop's job, not Hydrogen's. A VPN that owns the default routes is something the user set up and can see; Hydrogen will not add an outbound probe or a network narrative for it.

Log in to reply.