faffter-noon-transport-private-network

Resolves the evaluator's base host for private-network reachability across docker and Fly substrates.

3|Updated Apr 16, 2026
One-click install
npx skills add https://github.com/shftwst/faff --skill faffter-noon-transport-private-network-shftwst
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: faffter-noon-transport-private-network
Source: https://github.com/shftwst/faff/tree/main/plugin/skills/faffter-noon-transport-private-network
Command: npx skills add https://github.com/shftwst/faff --skill faffter-noon-transport-private-network-shftwst

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? When an evaluator runs in a separate lane from the system under build, determining how it reaches that system over a private network is error-prone — especially across rootful versus rootless Docker engines and different substrates. This Skill deterministically resolves the correct base host so the evaluator can reach the system without application-layer authentication. ## Core Features & Use Cases - Deterministic topology resolution: Switches on the evaluator_topology field of the provision context — co-resident returns localhost, dind-in-cage and cross-machine trigger re-basing — never inferring from ambiguous signals. - Rootless-aware Docker handling: Detects rootless Docker engines via docker info and selects a shared user-defined network instead of the host-gateway address, which does not route under rootless. - Substrate branches: Covers local docker-in-docker today and documents the Fly 6PN (private IPv6) branch for cross-machine follow-ons, returning optional teardown instructions for transient networking artifacts. - Use Case: During an L4 unattended delivery run, the env occupant calls this transport slot to learn that the evaluator container must reach the system under build via a shared Docker network alias, then threads that host through the validated --base-host seam. ## Quick Start Compose this Skill into the transport slot of an env configuration and let it resolve the evaluator base host from the provision context automatically.

Frequently Asked Questions about faffter-noon-transport-private-network

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I reach a system under build from an evaluator in a separate Docker container?▼

Resolve the base host based on the evaluator topology: co-resident setups use localhost, while docker-in-cage setups use either the host-gateway address on rootful engines or a shared user-defined Docker network alias on rootless engines.

Why does host.docker.internal not work with rootless Docker?▼

Rootless Docker publishes host ports inside rootlesskit's own network namespace, so the bridge gateway is unreachable from a sibling container. Use a shared user-defined Docker network that both the evaluator and the system under build join instead.

How do I detect whether a Docker engine is rootless?▼

Inspect the output of docker info for the rootless security option or a rootless context. This detection determines whether the resolver selects the host-gateway mechanism or the shared-network mechanism.

Can this approach work across separate machines?▼

Yes, the cross-machine topology uses a Fly 6PN private IPv6 address as the base host, which is static and known ahead of provisioning. Any transient WireGuard peers created are removed through the returned teardown reference.

How is the resolved base host protected against command injection?▼

The base host is passed through a positive allowlist validator that accepts only bare hostnames, IP literals, or bracketed IPv6 addresses before any interpolation into endpoint strings. Malformed values fail composition loudly without emitting a compose file.