v24.7.32: dnsmasq zombie leak + wolfnet config save + VM network save

Three Sponsor-reported fixes ship together.

* KO4BSR 2026-05-28: 1300+ defunct dnsmasq processes parented to
  wolfstack on his node. Root cause: `Command::new("dnsmasq").spawn()`
  in both `ensure_lxcbr0_services` (containers) and the per-TAP
  WolfNet DHCP setup (vms) launched dnsmasq and dropped the Child
  handle without ever calling `.wait()`. dnsmasq daemonizes by double-
  fork, so its initial process exits the moment the daemon is forked
  — and that initial process becomes a zombie under wolfstack
  because nothing reaps it. Switched both call sites to `.status()`
  so the parent dnsmasq is reaped synchronously after its quick
  daemonize fork. Restarting wolfstack clears the existing pile.

* Klas (Sponsor) 2026-05-28 #1: editing the listen port on one node
  wiped `/etc/wolfnet/config.toml` and wolfnet then exited on every
  start. WolfStack-side `save_wolfnet_config` and the four other
  paths that rewrote the file now route through one helper that
  refuses empty/malformed payloads, snapshots the existing file to
  `config.toml.bak`, and atomic-renames a `.tmp` into place. wolfnet
  0.5.25 (shipped separately) adds the matching self-heal on the
  load side: if config.toml is missing or empty but .bak exists,
  it gets restored before parsing.

* Klas (Sponsor) 2026-05-28 #2: "trying to change a network setting
  on a vm and an unable to click save button; a little later it
  says settings saved but settings have not been changed" on a
  Proxmox node. Two issues:
    - The Save/Cancel footer in the VM-settings modal scrolled with
      the body and could end up below the viewport on small screens.
      Made it position:sticky to the bottom of the modal-body so it
      is always reachable.
    - On the Proxmox update path, `qm set --net0`, `qm set --net1`,
      and the WolfNet bridge reconcile all logged a warning and
      returned Ok(()) on failure — so the handler answered 200 to
      the API and the UI showed a success toast while PVE had
      rejected the change. All three now propagate the error so the
      frontend surfaces what PVE actually said. `qm set --delete
      net1` keeps treating "net1 not in config" as a no-op since
      that's the desired state.

Author: Paul C

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "wolfstack"
-version = "24.7.31"
+version = "24.7.32"
 edition = "2024"
 authors = ["Wolf Software Systems Ltd"]
 description = "Server management platform for the Wolf software suite"

src/containers/mod.rs

@@ -1897,6 +1897,14 @@ fn ensure_lxcbr0_services(_used_lxc_net: bool) {
 
     if !dns_in_use && !dnsmasq_running {
         let _ = std::fs::create_dir_all("/run/lxc");
+        // `.status()`, not `.spawn()`: dnsmasq daemonizes by double-fork,
+        // and its initial process exits the moment it has forked the
+        // daemon. If we `.spawn()` and drop the Child handle we never
+        // reap that initial process — it stays as a `<defunct>` zombie
+        // parented to wolfstack. KO4BSR 2026-05-28: 1300+ defunct
+        // dnsmasq under wolfstack on a node where this reconcile fires
+        // every minute. `.status()` blocks just long enough for the
+        // daemonize fork to complete (typically <100ms) and reaps it.
         let _ = Command::new("dnsmasq")
             .args([
                 "--strict-order",
@@ -1912,7 +1920,7 @@ fn ensure_lxcbr0_services(_used_lxc_net: bool) {
                 "--interface=lxcbr0",
                 "--conf-file=", // avoid reading /etc/dnsmasq.conf
             ])
-            .spawn();
+            .status();
     }
 
     // Forwarding sysctl on the bridge — separate from global ip_forward

src/networking/mod.rs

@@ -789,11 +789,81 @@ pub fn get_wolfnet_local_info() -> Option<serde_json::Value> {
     }))
 }
 
+/// Atomic + backup write of `/etc/wolfnet/config.toml`. Every code
+/// path that updates the WolfNet config goes through here.
+///
+/// Three guarantees on top of a plain `fs::write`:
+///   1. **No empty replaces.** If the caller hands us a blank or
+///      whitespace-only payload we refuse the write outright. A
+///      truncated payload that survives serialisation but is missing
+///      the [network]/[security] sections also fails the load-check
+///      below, so the original file stays intact. klasSponsor
+///      2026-05-28 reported `config.toml` being wiped after a port
+///      edit on one node — wolfnet then exited on next start because
+///      it had no config to load. This check makes that class of
+///      regression impossible regardless of which call site is at
+///      fault.
+///   2. **`config.toml.bak` snapshot before every replace.** Always
+///      written when the on-disk file is non-empty. Manual recovery
+///      becomes `cp config.toml.bak config.toml`, and the wolfnet
+///      daemon also picks it up automatically (see wolfnet's
+///      `Config::load_from_file`).
+///   3. **Atomic rename**, not in-place truncate. A crash partway
+///      through the write can no longer leave the live config
+///      truncated/empty — the previous file remains visible until
+///      the rename completes.
+fn write_wolfnet_config_atomic(content: &str) -> Result<(), String> {
+    const PATH: &str = "/etc/wolfnet/config.toml";
+    const TMP: &str = "/etc/wolfnet/config.toml.tmp";
+    const BAK: &str = "/etc/wolfnet/config.toml.bak";
+
+    if content.trim().is_empty() {
+        return Err(
+            "Refusing to write empty WolfNet config (would brick the daemon). \
+             Existing config left untouched.".to_string(),
+        );
+    }
+
+    // Sanity-check: a real wolfnet config always carries at least
+    // [network] and [security] sections. Anything missing both is a
+    // tell-tale of a serialisation bug upstream — fail fast rather
+    // than overwrite a working file with garbage.
+    if !content.contains("[network]") || !content.contains("[security]") {
+        return Err(
+            "Refusing to write WolfNet config missing [network]/[security] sections. \
+             Existing config left untouched.".to_string(),
+        );
+    }
+
+    // Make sure /etc/wolfnet exists — write to .tmp first.
+    if let Some(parent) = std::path::Path::new(PATH).parent() {
+        let _ = std::fs::create_dir_all(parent);
+    }
+    std::fs::write(TMP, content)
+        .map_err(|e| format!("Failed to stage WolfNet config at {}: {}", TMP, e))?;
+
+    // Snapshot the previous good config to .bak — best-effort: an
+    // absent .bak isn't fatal, but we want a recovery copy after
+    // every successful replace.
+    if std::path::Path::new(PATH).exists() {
+        let _ = std::fs::copy(PATH, BAK);
+    }
+
+    // Atomic rename — POSIX guarantees this is either fully visible
+    // or fully not.
+    std::fs::rename(TMP, PATH).map_err(|e| {
+        format!(
+            "Failed to install new {} (staged copy left at {}): {}",
+            PATH, TMP, e
+        )
+    })?;
+
+    Ok(())
+}
+
 /// Save the raw WolfNet config file
 pub fn save_wolfnet_config(content: &str) -> Result<String, String> {
-    std::fs::write("/etc/wolfnet/config.toml", content)
-        .map_err(|e| format!("Failed to write WolfNet config: {}", e))?;
-
+    write_wolfnet_config_atomic(content)?;
     Ok("Configuration saved".to_string())
 }
 
@@ -1054,8 +1124,7 @@ pub fn add_wolfnet_peer(name: &str, endpoint: PeerEndpoint, ip: &str, public_key
         // whether we cleared an endpoint (see above).
         let output = toml::to_string_pretty(&doc)
             .map_err(|e| format!("Failed to serialize config: {}", e))?;
-        std::fs::write(config_path, &output)
-            .map_err(|e| format!("Failed to write config: {}", e))?;
+        write_wolfnet_config_atomic(&output)?;
         if cleared_endpoint {
             restart_wolfnet();
         } else {
@@ -1103,8 +1172,7 @@ pub fn add_wolfnet_peer(name: &str, endpoint: PeerEndpoint, ip: &str, public_key
     // Write back
     let output = toml::to_string_pretty(&doc)
         .map_err(|e| format!("Failed to serialize config: {}", e))?;
-    std::fs::write(config_path, &output)
-        .map_err(|e| format!("Failed to write config: {}", e))?;
+    write_wolfnet_config_atomic(&output)?;
 
     // Apply config: try SIGHUP hot-reload, fall back to restart for older wolfnet
     reload_or_restart_wolfnet();
@@ -1394,8 +1462,7 @@ pub fn reconcile_wolfnet_peers_batch(
     // Write the whole updated config once.
     let output = toml::to_string_pretty(&doc)
         .map_err(|e| format!("Failed to serialize config: {}", e))?;
-    std::fs::write(config_path, &output)
-        .map_err(|e| format!("Failed to write config: {}", e))?;
+    write_wolfnet_config_atomic(&output)?;
 
     // ONE reload/restart at the end. If any peer was cleared and we're
     // running against a pre-0.5.22 wolfnet whose SIGHUP handler doesn't
@@ -1478,8 +1545,7 @@ pub fn remove_wolfnet_peer(name: &str) -> Result<String, String> {
     }
 
     let new_content = result_lines.join("\n");
-    std::fs::write(config_path, &new_content)
-        .map_err(|e| format!("Failed to write config: {}", e))?;
+    write_wolfnet_config_atomic(&new_content)?;
 
 
 

src/vms/manager.rs

@@ -1484,8 +1484,20 @@ impl VmManager {
                         let out = Command::new("qm").args(["set", &vmid_str, "--net0", &val]).output()
                             .map_err(|e| format!("qm set --net0 failed: {}", e))?;
                         if !out.status.success() {
+                            // Propagate the PVE error instead of warning-and-
+                            // succeeding. klasSponsor 2026-05-28 reported
+                            // "settings saved but settings have not been
+                            // changed" — the silent warn here is why: qm
+                            // rejected the change (e.g., bridge missing on the
+                            // host, running-VM restriction, perms) and the
+                            // handler still returned 200, so the UI showed
+                            // success while PVE kept the old config.
                             let stderr = String::from_utf8_lossy(&out.stderr);
-                            warn!("qm set --net0 for VMID {} failed: {}", vmid, stderr.trim());
+                            return Err(format!(
+                                "qm set --net0 for VMID {} failed: {}",
+                                vmid,
+                                stderr.trim()
+                            ));
                         }
                     }
                 }
@@ -1541,21 +1553,58 @@ impl VmManager {
                         if !wip.is_empty() {
                             self.ensure_dnsmasq_installed();
                             let bridge = Self::wn_bridge_name(&vmid_str);
-                            if let Err(e) = self.setup_wolfnet_bridge(&bridge, wip) {
-                                warn!("WolfNet bridge reconcile (qm) for VMID {} failed: {}", vmid, e);
-                            } else {
-                                let _ = Command::new("qm").args([
-                                    "set", &vmid_str, "--net1",
-                                    &format!("virtio,bridge={}", bridge)
-                                ]).output();
+                            // Bridge setup or `qm set --net1` failures used
+                            // to be swallowed silently — the UI showed
+                            // "settings saved" with no actual NIC change.
+                            // Surface both so the operator sees the real
+                            // reason (klasSponsor 2026-05-28).
+                            self.setup_wolfnet_bridge(&bridge, wip).map_err(|e| {
+                                format!(
+                                    "WolfNet bridge reconcile (qm) for VMID {} failed: {}",
+                                    vmid, e
+                                )
+                            })?;
+                            let out = Command::new("qm").args([
+                                "set", &vmid_str, "--net1",
+                                &format!("virtio,bridge={}", bridge)
+                            ]).output()
+                                .map_err(|e| format!("qm set --net1 failed: {}", e))?;
+                            if !out.status.success() {
+                                let stderr = String::from_utf8_lossy(&out.stderr);
+                                return Err(format!(
+                                    "qm set --net1 for VMID {} failed: {}",
+                                    vmid,
+                                    stderr.trim()
+                                ));
                             }
                         }
                     }
                 } else {
                     // Mode is explicitly non-wolfnet — drop net1 if present.
-                    // qm errors when net1 doesn't exist; the result is
-                    // ignored on purpose (the desired state IS "no net1").
-                    let _ = Command::new("qm").args(["set", &vmid_str, "--delete", "net1"]).output();
+                    // qm errors when net1 doesn't exist; that specific case
+                    // is the desired state and stays ignored, but any other
+                    // failure (e.g., permissions) needs to surface so the
+                    // UI doesn't report a false success.
+                    let out = Command::new("qm").args(["set", &vmid_str, "--delete", "net1"]).output();
+                    if let Ok(o) = &out {
+                        if !o.status.success() {
+                            let stderr = String::from_utf8_lossy(&o.stderr);
+                            let stderr_trim = stderr.trim();
+                            // PVE phrases the "net1 not in config" rejection
+                            // as `unable to find net1 in config`; treat that
+                            // as a no-op since the desired state is already
+                            // met.
+                            let is_already_gone = stderr_trim.contains("net1")
+                                && (stderr_trim.contains("not in config")
+                                    || stderr_trim.contains("does not exist"));
+                            if !is_already_gone {
+                                return Err(format!(
+                                    "qm set --delete net1 for VMID {} failed: {}",
+                                    vmid, stderr_trim
+                                ));
+                            }
+                        }
+                    }
                     let bridge = Self::wn_bridge_name(&vmid_str);
                     self.cleanup_wolfnet_bridge(&bridge, wolfnet_ip.as_deref());
                 }
@@ -3014,6 +3063,15 @@ impl VmManager {
             let lease_file = format!("/run/dnsmasq-{}.leases", tap);
             let _ = std::fs::remove_file(&lease_file);
             let dns_server = "8.8.8.8";
+            // `.status()`, not `.spawn()`: dnsmasq daemonizes by double-
+            // fork, so the immediate child we launched exits the moment
+            // the daemon is forked. If we `.spawn()` and never `.wait()`
+            // on the Child, that initial process becomes a `<defunct>`
+            // zombie parented to wolfstack — one per TAP setup, forever.
+            // KO4BSR 2026-05-28 saw 1300+ accumulate under wolfstack.
+            // `.status()` blocks for the ~100ms it takes dnsmasq to
+            // fork-and-exit, reaps the parent, and the daemonized child
+            // gets reparented to init as normal.
             let dnsmasq_result = Command::new("dnsmasq")
                 .args([
                     &format!("--interface={}", tap),
@@ -3040,14 +3098,15 @@ impl VmManager {
                 ])
                 .stdout(std::process::Stdio::null())
                 .stderr(std::process::Stdio::null())
-                .spawn();
+                .status();
 
             match dnsmasq_result {
-                Ok(_child) => {
-                    // `Command::spawn()` returns Ok the moment fork+exec
-                    // succeeds — but dnsmasq can still abort a moment
-                    // later if its bind() fails (`Address already in
-                    // use`, missing perms, kernel misconfig, etc.).
+                Ok(_status) => {
+                    // `.status()` returns once the parent dnsmasq has
+                    // exited the daemonize fork — but dnsmasq can still
+                    // abort a moment later if its bind() fails (`Address
+                    // already in use`, missing perms, kernel misconfig,
+                    // etc.).
                     // Verify the daemon actually stayed up and the pid
                     // file points at a live process bound to OUR tap.
                     // If it didn't, log loudly so the predictive

web/js/app.js

@@ -26225,9 +26225,16 @@ async function showVmSettings(name) {
                 </div>
             </div>
 
-            <!-- Footer (always visible) -->
-            <div style="display:flex; gap:8px; margin-top:16px; padding-top:12px; border-top:1px solid var(--border);">
-                <button class="btn btn-primary" onclick="saveVmSettings('${vm.name}')">Save</button>
+            <!-- Footer pinned to the bottom of the scrollable modal-body.
+                 Was a plain inline div that scrolled with the rest of the
+                 content — on smaller viewports (or with the Boot Options +
+                 passthrough lists expanded) the Save button could end up
+                 below the visible area, and klasSponsor 2026-05-28 hit
+                 exactly that: "unable to click save button" while changing
+                 a VM's network setting. Sticky positioning keeps Save/Cancel
+                 reachable no matter where the user has scrolled to. -->
+            <div style="display:flex; gap:8px; padding:12px 24px; margin:16px -24px -24px -24px; border-top:1px solid var(--border); position:sticky; bottom:-24px; background:var(--bg-card); z-index:5;">
+                <button class="btn btn-primary" onclick="saveVmSettings('${escapeAttr(vm.name)}')">Save</button>
                 <button class="btn" onclick="closeContainerDetail()">Cancel</button>
             </div>
         `;