Skip to content

add min and max ports for vnc range - #1013

Open
Oglopf wants to merge 2 commits into
masterfrom
vnc-port-range
Open

Oglopf wants to merge 2 commits into
masterfrom
vnc-port-range

Conversation

@Oglopf

@Oglopf Oglopf commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

What does this PR do?

VNC apps now keep the VNC server's own port inside min_port/max_port when either is set, in the cluster's batch_connect.vnc config or in the app's submit.yml.erb.

Before, the range only applied to the websocket port, and the VNC server always listened on 5900 + its display number. With a range set, the template picks a free port in it and starts vncserver with -rfbport. Without one, the generated script is the same as before (apart from whitespace). Covers both the vnc and vnc_container templates.

-rfbport works with TurboVNC 2.x and 3.x. 3.x handles it in vncserver; 2.x passes it to Xvnc after its own default, and Xvnc uses the last value.

Related issue

Closes #933

Testing

  • Tests included: test/batch_connect/vnc_port_range_test.rb runs the template's startup against a fake vncserver and checks the default port (5900 + display), a port inside the range, skipping a port already in use, a range with only one end set, and the container template.

Anything else?

This reuses the existing min_port/max_port rather than adding VNC-specific options, because that's what the issue reporter tried first. The tradeoff: a site that already sets them for VNC apps will see the VNC server move off 59xx into that range. That only matters for users connecting a native VNC client directly to the node, and the port in the connection info is still correct. If you'd rather it be opt-in, separate vnc_min_port/vnc_max_port options are a small change.

@Oglopf

Oglopf commented Oct 6, 2026

Copy link
Copy Markdown
Contributor Author

Once #1006 gets merged I will rebase this PR and it will be ready for review.

@johrstrom johrstrom self-assigned this Oct 13, 2026
@johrstrom

Copy link
Copy Markdown
Contributor

These tests hang for me like half the time or more. I wonder if there's a simpler way to test these, maybe just a fixture file comparison?

The hang Jeff saw was the old port_used trying nc first. On RHEL and
Fedora nc is ncat, where -w only limits the connect, so checking the
port the skip test held open (accepting nothing) waited forever. shuf
picked that port first about half the time. Rebasing onto #1002, which
reads /proc/net/tcp instead, removes it.

The tests now mostly check the generated script, as Jeff suggested.
Two still run the startup, to show the picked port reaches vncserver
and is the one the job reports. Those run under a 30s timeout, with
BASH_ENV unset (Lmod makes every bash source its init), and the fake
vncserver waits for its Xvnc like the real one does, so pgrep can't
miss it. Skipping a port in use is find_port's job and is already
tested in template_test.rb, so that test is gone.
@Oglopf

Oglopf commented Oct 20, 2026

Copy link
Copy Markdown
Contributor Author

Found it I think: the old port_used tried nc first, and on Fedora/RHEL nc is ncat, where -w only limits the connect. The test held a port open that never accepts, so ncat waited forever whenever shuf tried that port first. #1002 removed nc, and this is now rebased on it. I also took your suggestion: most tests now just check the generated script. Two still run the startup, with a timeout so a hang can’t stall the suite again.

#{vnc_port_pick}
# Attempt to start VNC server
VNC_OUT=$(#{vncserver_cmd} -log "#{vnc_log}" -rfbauth "#{vnc_passwd}" $HTTPD_OPT -noxstartup #{vnc_args} 2>&1)
VNC_OUT=$(#{vncserver_cmd} -log "#{vnc_log}" -rfbauth "#{vnc_passwd}" $HTTPD_OPT -noxstartup #{vnc_port_arg} #{vnc_args} 2>&1)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm now wondering if we should just force the port argument all the time. Reviewing this output, the port can be set above in vnc_port_pick or set below in vnc_default_port.

I wonder if it's easier for debugging and maintenance to just force the -rfbport all the time and only have one spot where the variable port can be set whether a minimum or maximum is set or the defaults used.

Trying to think why a center would need 5900+display and have setup machinery (like firewalld rules) around that and all I can think is they opened these ports specifically in which case they'd want to use mins and maxes anyhow.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Allow custom VNC port range to be specified in cluster configurations and apps

2 participants