Fixes for coderabbit.

docs/docker-troubleshooting/aufs-capabilities.md

@@ -26,8 +26,11 @@ The container is designed to inspect the runtime environment at startup (`/root-
 
 ### Warning Log
 When AUFS is detected without root privileges, the system emits the following warning during startup:
-> ⚠️ **WARNING:** Legacy AUFS storage driver detected. AUFS strips file capabilities (setcap). Layer-2 scanners will fail.
+> ⚠️  WARNING: Reduced functionality (AUFS + non-root user).
-> **Action:** Set PUID=0 in your config or migrate off AUFS.
+> 
+> AUFS strips Linux file capabilities, so tools like arp-scan, nmap, and nbtscan fail when NetAlertX runs as a non-root PUID.
+>
+> **Action:** Set PUID=0 on AUFS hosts for full functionality.
 
 
 ## Security Ramifications
@@ -144,12 +147,15 @@ docker exec netalertx getcap /usr/sbin/arp-scan
 ```
 
 **3. Simulating AUFS (Dev/Test)**
-Developers can force the AUFS logic path on a modern machine by mocking the mounts file:
+Developers can force the AUFS logic path on a modern machine by mocking the mounts file. Note: Docker often restricts direct bind-mounts of host `/proc` paths, so the test suite uses an environment-variable injection instead (see `test_puid_pgid.py`).
 
 ```bash
-echo "none / aufs rw,relatime 0 0" > /tmp/mock_mounts
+# Create mock mounts content and encode it as base64
-docker run --rm -v /tmp/mock_mounts:/proc/mounts:ro netalertx/netalertx
+echo "none / aufs rw,relatime 0 0" | base64
 
+# Run the container passing the encoded mounts via NETALERTX_PROC_MOUNTS_B64
+# (the entrypoint decodes this and uses it instead of reading /proc/mounts directly)
+docker run --rm -e NETALERTX_PROC_MOUNTS_B64="bm9uZSAvIGF1ZnMgcncs..." netalertx/netalertx
 ```
 
 ## Additional Resources

test/docker_tests/test_puid_pgid.py

@@ -248,6 +248,7 @@ def test_aufs_explicit_root_no_warning() -> None:
         mock_file_path = f"/tmp/mock_mounts_{uuid.uuid4().hex[:8]}"
         with open(mock_file_path, "w") as f:
             f.write(mock_mounts_content)
+        try:
             # Run with explicit PUID=0 - should not warn about non-root
             result = _run_root_entrypoint(
                 env={"PUID": "0", "PGID": "0", "SKIP_TESTS": "1"},
@@ -259,8 +260,9 @@ def test_aufs_explicit_root_no_warning() -> None:
             assert "Running as root (PUID=0)" in combined, f"Should confirm running as root: {combined}"
             # Should NOT have the AUFS reduced functionality warning when running as root
             assert "Reduced functionality (AUFS + non-root user)" not in combined, f"Should not warn when explicitly using root: {combined}"
-
+        finally:
             # Clean up mock file
+            if os.path.exists(mock_file_path):
                 os.unlink(mock_file_path)
 
     finally:
@@ -281,6 +283,7 @@ def test_aufs_non_root_warns() -> None:
         with open(mock_file_path, "w") as f:
             f.write(mock_mounts_content)
 
+        try:
             result = _run_root_entrypoint(
                 env={"PUID": "20211", "PGID": "20211"},
                 volumes=[f"{volume}:/data", f"{mock_file_path}:/proc/mounts:ro"],
@@ -290,7 +293,8 @@ def test_aufs_non_root_warns() -> None:
             assert result.returncode == 0, f"Container should continue with warnings: {combined}"
             assert "Reduced functionality (AUFS + non-root user)" in combined, f"AUFS warning missing: {combined}"
             assert "aufs-capabilities" in combined, "Warning should link to troubleshooting guide"
-
+        finally:
+            if os.path.exists(mock_file_path):
                 os.unlink(mock_file_path)
 
     finally: