Disable IPv6 in browser VMs at boot

[sjmiller609]

Summary

Disables IPv6 at the kernel level during VM boot in both headful and headless wrapper scripts.

Browser VMs have no IPv6 route, so any IPv6 connection attempt fails immediately with ENETUNREACH. Chromium's built-in DNS client may attempt DNS-over-HTTPS to IPv6 endpoints (e.g. [2001:4860:4860::8888]:443), and each failed attempt wastes a connection slot from the MaxConnectionsPerProxy pool. Under certain conditions — particularly when combined with intermittent DNS failures — this can exhaust all available connection slots and lead to ERR_INSUFFICIENT_RESOURCES tab crashes.

Changes

• images/chromium-headful/wrapper.sh — write 1 to /proc/sys/net/ipv6/conf/{all,default}/disable_ipv6 after hostname setup, before service startup
• images/chromium-headless/image/wrapper.sh — same change

Uses the same /proc/sys write pattern already used for hostname configuration. Writes are best-effort (|| true) so the script continues if the sysctl paths are unavailable.

Testing

Verified on a live stealth browser VM (gb732pp14lssq510l2lq4q53):

• Before: net.ipv6.conf.all.disable_ipv6 = 0, link-local IPv6 addr on eth0, IPv6 ping fails with "Network is unreachable"
• Observed 8.8.4.4:443 in TIME_WAIT at startup — Chrome's DoH probe to Google DNS over IPv4 (IPv6 attempt would have also fired)
• After manually applying the sysctl: IPv6 addresses removed from interfaces, no more IPv6 connection attempts possible

---

Note

Medium Risk
Low code complexity, but it changes VM networking behavior at the kernel level and could impact workloads that rely on IPv6 connectivity.

Overview
Disables IPv6 at boot in both headful and headless Chromium VM wrapper scripts by writing 1 to /proc/sys/net/ipv6/conf/{all,default}/disable_ipv6 (best-effort), to prevent Chromium making futile IPv6 DoH/proxy connection attempts that can exhaust connection slots and trigger ERR_INSUFFICIENT_RESOURCES crashes.

^{Reviewed by Cursor Bugbot for commit b99ba46. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: PR modifies VM wrapper scripts and kernel parameters, not API endpoints or Temporal workflows as specified in the filter.

To monitor this PR anyway, reply with @firetiger monitor this.