v0.18.1

Follow-ups to the v0.18.0 field report: one determinism fix in two halves, and the prerequisites that turned out to be undocumented.

Fixed — Kafka consumer groups no longer leak offsets between tests

Kafka-consuming specs were non-deterministic at a fixed seed, and the seed could never have fixed it: the state is in the broker, not in Faultbox.

Both consumer paths used the constant group ID "faultbox". A consumer group's committed offsets live in __consumer_offsets and outlive the reader that wrote them, so the second test to consume resumed after whatever the first had committed — and a broker container kept across tests, which is normal because brokers are slow to start, carried that state between whole runs. What a test saw depended on what had run before it.

The default group is now scoped to (run, test). Such a group has never committed anything, so kafka-go's FirstOffset default applies and the read starts at the beginning every time. A spec that is about consumer-group semantics — rebalances, redelivery, offset commits — passes group= explicitly and still gets a stable name.

Landed in two commits, and the second is worth recording: the first claimed to have scoped both consumer paths and had scoped one. applyKafkaGroupDefault is reached only from the step path, so the topic() event source kept the constant group. Both are fixed.

Known limit. Reading from offset 0 on a reused broker means a test sees the first message on the topic, which may be an earlier test's. This makes runs reproducible, which is what was reported; it does not isolate topic contents between tests. That needs per-test topics or a broker reset, and is a design decision rather than a bug fix.

Documentation

• gvisor-requirements.md — the requirements for the two gVisor-backed features, in one place. They are not the same set, and the previous scattering across five documents made them look like one: packet faults need CAP_NET_ADMIN and /dev/net/tun but not runsc; watch() needs runsc and a one-time host registration but no elevated capability.
• Packet faults need root, and that now leads the tutorial chapter rather than appearing as a clause. Creating a TUN device is privileged, and without one the gateway sees nothing. Includes the setcap alternative for machines where sudo-per-run is awkward.
• protocols/kafka.md documents why a Kafka fault rule may never match, and the workaround. Clients ask the broker where it is and then open every later connection to that address, so a rule sees the bootstrap exchange and nothing else. Pointing KAFKA_ADVERTISED_LISTENERS at kafka.main.proxy_addr — late-bound, so it resolves after the proxy has a port — keeps the client on the mediated path. Single-broker only.
• RFC-057 scopes the general fix. Protocols that advertise their own address take the client off the mediated path after the handshake: Kafka's Metadata, Redis Cluster's CLUSTER SLOTS, MongoDB's hello.hosts. Confirmed in code — the Kafka proxy inspects only Produce and Fetch, so Metadata is forwarded byte-for-byte.

Full notes in CHANGELOG.md.

What's Changed

• fix(eventsource): scope the topic observer's consumer group; retarget dead RFC links by @avatar29A in #157

Full Changelog: release-0.18.0...release-0.18.1