fix test

Signed-off-by: kerthcet <kerthcet@gmail.com>

Author: kerthcet

hack/docker/docker-compose.tunnel-e2e.yml

@@ -20,12 +20,13 @@
 #   with remote DNS (socks5h). Without that wiring in sandd, this test hangs at
 #   "daemon failed to connect"; with it, the daemon connects and exec works.
 #
-# ASYMMETRY (mirrors Nebula, deliberately):
-#   - controller: NET_ADMIN + /dev/net/tun. It is the INFRA side (in-cluster), and
-#     accepting INBOUND mesh connections on a normal listening socket needs a real
-#     TUN. This is not the constrained side, so privilege here is fine.
-#   - daemon: UNPRIVILEGED, userspace-networking. This is the TENANT side (the GPU
-#     workload container) — exactly what must work without NET_ADMIN/TUN.
+# BOTH SIDES RUN USERSPACE-NETWORKING (Server(connect="tunnel") and sandd --tunnel
+# each start `tailscaled --tun=userspace-networking`). The controller keeps
+# NET_ADMIN + /dev/net/tun only as a harmless fallback / to mirror the infra side
+# of Nebula; in userspace mode tailscaled forwards inbound mesh TCP to the local
+# :8765 listener, so no kernel TUN is actually required. The daemon is deliberately
+# UNPRIVILEGED (no NET_ADMIN/TUN) — that is the TENANT side (the GPU workload
+# container) and the exact constraint this test proves works.
 #
 # Orchestrated by python/tests/test_e2e_tunnel.py (mints the auth key between
 # `up headscale` and `up controller daemon`). Not part of the default e2e run.
@@ -58,27 +59,29 @@ services:
       - -c
       - |
         set -e
-        echo "[ctrl] starting tailscaled (kernel TUN, infra side)"
-        tailscaled --state=/var/lib/tailscale/tailscaled.state &
-        sleep 3
-        tailscale up \
-          --authkey="${SANDD_TUNNEL_AUTH_KEY:-}" \
-          --login-server=http://headscale:8080 \
-          --hostname=controller \
-          --accept-routes
-        echo "[ctrl] mesh IP: $$(tailscale ip -4)"
+        # Do NOT run tailscaled/`tailscale up` here: Server(connect="tunnel")
+        # brings up its own tailscaled (--tun=userspace-networking) and runs
+        # `tailscale up` internally (server/src/lib.rs setup_tunnel_controller).
+        # A manual `tailscale up` first would set --hostname, and the Server's
+        # second `up` (which omits it) then fails tailscale's "must mention all
+        # non-default flags" guard. The tailnet hostname comes from the OS
+        # hostname instead, which compose sets via `hostname: controller` below
+        # -> MagicDNS name controller.sandd.local.
         python3 -u << 'PYEOF'
         import os, time
         from sandd import Server, TunnelConfig
         cfg = TunnelConfig(authkey=os.environ["SANDD_TUNNEL_AUTH_KEY"],
                            server="http://headscale:8080")
-        # The server joins the mesh via the running tailscaled/TUN above and
-        # listens on :8765 across it.
+        # Server joins the mesh (userspace-networking) and listens on :8765;
+        # tailscale proxies inbound mesh connections to this local listener.
         server = Server(host="0.0.0.0", port=8765, connect="tunnel", tunnel_config=cfg)
         print("[ctrl] controller ready, waiting for daemons", flush=True)
         seen = set()
         while True:
-            for did in server.list_daemons():
+            # list_daemons() returns DaemonInfo objects; exec() and the log
+            # markers want the plain id string (d.id), not the object repr.
+            for d in server.list_daemons():
+                did = d.id
                 if did not in seen:
                     seen.add(did)
                     print(f"[ctrl] DAEMON_CONNECTED {did}", flush=True)