Update docker compose and unit tests

test/docker_tests/test_docker_compose_scenarios.py

@@ -344,6 +344,7 @@ def _write_normal_startup_compose(
 
     service_env = service.setdefault("environment", {})
     service_env.setdefault("NETALERTX_CHECK_ONLY", "1")
+    service_env.setdefault("SKIP_STARTUP_CHECKS", "host optimization")
 
     if env_overrides:
         service_env.update(env_overrides)
@@ -885,9 +886,14 @@ def test_normal_startup_no_warnings_compose(tmp_path: pathlib.Path) -> None:
         f"Unexpected mount row values for /data: {data_parts[2:4]}"
     )
 
+    allowed_warning = "⚠️  WARNING: ARP flux sysctls are not set."
+
     assert "Write permission denied" not in default_output
     assert "CRITICAL" not in default_output
-    assert "⚠️" not in default_output
+    assert all(
+        "⚠️" not in line or allowed_warning in line
+        for line in default_output.splitlines()
+    ), "Unexpected warning found in default output"
 
     custom_http = _select_custom_ports({default_http_port})
     custom_graphql = _select_custom_ports({default_http_port, custom_http})
@@ -922,7 +928,10 @@ def test_normal_startup_no_warnings_compose(tmp_path: pathlib.Path) -> None:
     assert "❌" not in custom_output
     assert "Write permission denied" not in custom_output
     assert "CRITICAL" not in custom_output
-    assert "⚠️" not in custom_output
+    assert all(
+        "⚠️" not in line or allowed_warning in line
+        for line in custom_output.splitlines()
+    ), "Unexpected warning found in custom output"
     lowered_custom = custom_output.lower()
     assert "arning" not in lowered_custom
     assert "rror" not in lowered_custom

test/docker_tests/test_entrypoint.py

@@ -90,3 +90,40 @@ def test_skip_startup_checks_env_var():
     result = _run_entrypoint(env={"SKIP_STARTUP_CHECKS": "mandatory folders"}, check_only=True)
     assert "Creating NetAlertX log directory" not in result.stdout
     assert result.returncode == 0
+
+
+@pytest.mark.docker
+@pytest.mark.feature_complete
+def test_host_optimization_warning_matches_sysctl():
+    """Validate host-optimization warning matches actual host sysctl values."""
+    ignore_proc = subprocess.run(
+        ["sysctl", "-n", "net.ipv4.conf.all.arp_ignore"],
+        capture_output=True,
+        text=True,
+        check=False,
+        timeout=10,
+    )
+    announce_proc = subprocess.run(
+        ["sysctl", "-n", "net.ipv4.conf.all.arp_announce"],
+        capture_output=True,
+        text=True,
+        check=False,
+        timeout=10,
+    )
+
+    if ignore_proc.returncode != 0 or announce_proc.returncode != 0:
+        pytest.skip("sysctl values unavailable on host; skipping host-optimization warning check")
+
+    arp_ignore = ignore_proc.stdout.strip()
+    arp_announce = announce_proc.stdout.strip()
+    expected_warning = not (arp_ignore == "1" and arp_announce == "2")
+
+    result = _run_entrypoint(check_only=True)
+    combined_output = result.stdout + result.stderr
+    warning_present = "WARNING: ARP flux sysctls are not set." in combined_output
+
+    assert warning_present == expected_warning, (
+        "host-optimization warning mismatch: "
+        f"arp_ignore={arp_ignore}, arp_announce={arp_announce}, "
+        f"expected_warning={expected_warning}, warning_present={warning_present}"
+    )