From c88ab338c20dddce50bc751b3e01a1a136028a0d Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Sun, 20 Sep 2026 00:08:37 -0700 Subject: [PATCH] docs(guest-agent): say why v1 Health names containers ungated The dashboard's container table is gated on `public_sysinfo` or `public_logs`; `Health` names unhealthy containers to anyone. That reads as an oversight until you follow the consumer: `describe_unhealthy` in `gateway/src/proxy/health_check.rs` is the only thing outside the agent that reads the field, its output becomes `Observation.reason`, and `record_instance_health` prints it. Routing uses `healthy` alone -- but that log line is the only place a gateway operator learns which container held an instance out of rotation, and the external listener is one `0.0.0.0` socket, so there is no way to answer the gateway and not answer everyone else. Record the reasoning next to the field. --- dstack/guest-agent/rpc/proto/agent_rpc_v1.proto | 2 ++ 1 file changed, 2 insertions(+) diff --git a/dstack/guest-agent/rpc/proto/agent_rpc_v1.proto b/dstack/guest-agent/rpc/proto/agent_rpc_v1.proto index da50b62d1..3df408ad8 100644 --- a/dstack/guest-agent/rpc/proto/agent_rpc_v1.proto +++ b/dstack/guest-agent/rpc/proto/agent_rpc_v1.proto @@ -450,6 +450,8 @@ message HealthResponse { // The containers that made `healthy` false, so an operator reading gateway // logs can tell which one is holding the instance out of rotation. Purely // diagnostic -- the gateway routes on `healthy` alone. + // Not gated by `public_sysinfo`/`public_logs`: the gateway needs it, and the + // external listener is unauthenticated, so it cannot answer only the gateway. repeated ContainerHealth unhealthy = 2; // Set when the agent could not see the app at all for several refreshes in // a row (container runtime unreachable, permission denied). `healthy` is