From 6f07013db3754f1f1782176beaf20a4d424e4aa9 Mon Sep 17 00:00:00 2001 From: NamPham Date: Sun, 6 Sep 2026 07:59:54 +0700 Subject: [PATCH] dind: restore explicit DNS and a wider address pool The 2026-09-05 rewrite dropped the dns: list, so dockerd inside dind inherited the host's systemd-resolved (Tailscale DNS enabled) through Docker's embedded resolver and got SERVFAIL for every public name -- every job then died pulling the runner image, and Gitea left the jobs orphaned. Restores three settings, each documented inline: dns: for dockerd's own pulls, --dns for the job containers (tailnet resolver first, public second, so MagicDNS names resolve inside a job), and --default-address-pool so a CI run cannot exhaust the fifteen default /16s. Committed this time. The same settings were applied on 2026-09-03 without a commit and were lost to the next rewrite. --- docker-compose.yml | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index 3f2bdcf..854373d 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -14,9 +14,35 @@ services: # as an env var. A bare "tcp://..." isn't recognized and silently falls back # to /var/run/docker.sock, which doesn't exist in the runner container -- so # this shared socket is what makes `docker build` etc. work inside jobs. - command: ["dockerd", "--host=tcp://0.0.0.0:2375", "--host=unix:///var/run/docker.sock", "--host=unix:///dind-sock/docker.sock", "--tls=false"] + # Two DNS settings, for two different resolvers, and both are load-bearing. + # + # dns: (below) the dind CONTAINER's resolv.conf, which is what dockerd + # itself uses to pull images. Without an explicit list it + # inherits Docker's embedded resolver, which forwards to + # the host's systemd-resolved; with Tailscale DNS enabled + # there, public names come back SERVFAIL and every job + # dies at "docker pull" of the runner image itself. This + # is what took the runner down on 2026-09-05. + # + # --dns (here) what dockerd hands to the JOB containers it creates. + # The tailnet resolver first, so NOMAD_ADDR and the + # staging Postgres resolve inside a job (they are + # MagicDNS names); a public resolver second, because + # 100.100.100.100 answers only for the tailnet and + # SERVFAILs everything else -- getaddrinfo falls through. + # + # --default-address-pool replaces the daemon default of fifteen /16s in + # 172.17-172.31, which a CI run exhausts ("all predefined address pools + # have been fully subnetted"): the host holds three, each lane creates its + # own network, and a killed job leaves one behind. 10.210/16 in /24s is 256 + # networks and collides with nothing here (no 10.x route on the host; the + # tailnet is 100.64/10). + command: ["dockerd", "--host=tcp://0.0.0.0:2375", "--host=unix:///var/run/docker.sock", "--host=unix:///dind-sock/docker.sock", "--tls=false", "--dns=100.100.100.100", "--dns=1.1.1.1", "--default-address-pool", "base=10.210.0.0/16,size=24"] environment: DOCKER_TLS_CERTDIR: "" + dns: + - 1.1.1.1 + - 1.0.0.1 networks: - runner volumes: