[cdalar]

Problem

onctl create on a Firecracker host can spend 8 seconds in "Waiting for SSH" for a guest that has been listening since about 1.2 s.

Deploy allocates the lowest free address on the bridge, but each microVM's MAC is derived from its name. A reused address therefore arrives with a new MAC, while the host's neighbour cache may still map it to the MAC of a microVM that no longer exists. The kernel trusts the STALE entry, sends to the dead MAC, and re-resolves only after delay_first_probe_time (5 s) plus ucast_solicit unicast probes (3 x 1 s).

It only shows on hosts whose bridge stays up between creates (for example when long-lived VMs share it). A bridge that loses carrier when its last VM goes away flushes the cache, which is why one host was fast and another slow on the same guest image.

Measurements (same host, same image, 2 vCPU / 8 GB)

	onctl create	guest sshd listening
stale entry present	8.60 s	1.16 s
after ip neigh flush dev fcbr0 nud stale	1.55 s	1.14 s

Change

• NetworkManager gains ForgetNeighbor(bridge, ip); the Linux implementations run ip neigh del <ip> dev <bridge> and treat a missing entry as success.
• ProviderFC.Deploy and ProviderCH.Deploy call it for the address they just allocated, before the guest boots. The ch provider shares the allocator and the name-derived MAC, so it has the same exposure.
• Best-effort: a failure is logged at debug level and costs only the old delay.

Resume and Restart are untouched: they keep the VM's existing IP and MAC.

Test plan

• go build ./..., go vet (GOOS=linux) on the touched packages
• go test ./pkg/cloud/ ./internal/providerfc/ ./internal/providerch/ — deploy tests for both providers now assert the call
• golangci-lint run on the touched packages: 0 issues
• Not yet run on a real host: the 1.55 s figure comes from flushing the entry by hand, which is the state this change produces, not from a build of this branch

🤖 Generated with Claude Code

https://claude.ai/code/session_01AKmJku7417CUEaGfeQRx8C

[codecov]

Codecov Report

❌ Patch coverage is 16.66667% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 39.79%. Comparing base (1ddff76) to head (b20ab20).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/providerch/common.go	0.00%	4 Missing ⚠️
internal/providerfc/common.go	0.00%	4 Missing ⚠️
pkg/cloud/ch.go	50.00%	1 Missing ⚠️
pkg/cloud/fc.go	50.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1190      +/-   ##
==========================================
- Coverage   39.83%   39.79%   -0.04%     
==========================================
  Files          67       67              
  Lines        7298     7310      +12     
==========================================
+ Hits         2907     2909       +2     
- Misses       4391     4401      +10     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.