nampdn/act_runner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

dind: restore explicit DNS and a wider address pool

Browse Source 
The 2026-09-05 rewrite dropped the dns: list, so dockerd inside dind
inherited the host's systemd-resolved (Tailscale DNS enabled) through
Docker's embedded resolver and got SERVFAIL for every public name -- every
job then died pulling the runner image, and Gitea left the jobs orphaned.

Restores three settings, each documented inline: dns: for dockerd's own
pulls, --dns for the job containers (tailnet resolver first, public second,
so MagicDNS names resolve inside a job), and --default-address-pool so a CI
run cannot exhaust the fifteen default /16s.

Committed this time. The same settings were applied on 2026-09-03 without a
commit and were lost to the next rewrite.
This commit is contained in:
nampdn
2026-09-06 07:59:54 +07:00
parent 80a87aede9
commit 6f07013db3
1 changed files with 27 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker-compose.yml
+27 -1
View File
@@ -14,9 +14,35 @@ services:
# as an env var. A bare "tcp://..." isn't recognized and silently falls back
# to /var/run/docker.sock, which doesn't exist in the runner container -- so
# this shared socket is what makes `docker build` etc. work inside jobs.
command: ["dockerd", "--host=tcp://0.0.0.0:2375", "--host=unix:///var/run/docker.sock", "--host=unix:///dind-sock/docker.sock", "--tls=false"]
# Two DNS settings, for two different resolvers, and both are load-bearing.
#
# dns: (below) the dind CONTAINER's resolv.conf, which is what dockerd
# itself uses to pull images. Without an explicit list it
# inherits Docker's embedded resolver, which forwards to
# the host's systemd-resolved; with Tailscale DNS enabled
# there, public names come back SERVFAIL and every job
# dies at "docker pull" of the runner image itself. This
# is what took the runner down on 2026-09-05.
#
# --dns (here) what dockerd hands to the JOB containers it creates.
# The tailnet resolver first, so NOMAD_ADDR and the
# staging Postgres resolve inside a job (they are
# MagicDNS names); a public resolver second, because
# 100.100.100.100 answers only for the tailnet and
# SERVFAILs everything else -- getaddrinfo falls through.
#
# --default-address-pool replaces the daemon default of fifteen /16s in
# 172.17-172.31, which a CI run exhausts ("all predefined address pools
# have been fully subnetted"): the host holds three, each lane creates its
# own network, and a killed job leaves one behind. 10.210/16 in /24s is 256
# networks and collides with nothing here (no 10.x route on the host; the
# tailnet is 100.64/10).
command: ["dockerd", "--host=tcp://0.0.0.0:2375", "--host=unix:///var/run/docker.sock", "--host=unix:///dind-sock/docker.sock", "--tls=false", "--dns=100.100.100.100", "--dns=1.1.1.1", "--default-address-pool", "base=10.210.0.0/16,size=24"]
environment:
DOCKER_TLS_CERTDIR: ""
dns:
- 1.1.1.1
- 1.0.0.1
networks:
- runner
volumes: