# Split-horizon resolver for the runner's Docker daemon and every job
# container it starts.
#
# The host resolves the tailnet through MagicDNS on tailscale0 and everything
# else through Cloudflare on the default link (systemd-resolved split DNS).
# MagicDNS itself has no upstream configured for names outside the tailnet and
# answers them with SERVFAIL, so handing 100.100.100.100 to job containers as
# their first resolver made every public lookup (image pulls, *.localtest.me
# in the e2e lanes) wait on a failure before falling back -- long enough to
# time out a 5s Playwright poll. Only ts.net goes to MagicDNS here.
ts.net:53 {
    errors
    forward . 100.100.100.100
}
.:53 {
    errors
    cache 30
    forward . 1.1.1.1 1.0.0.1
}