From 9967f9cd7f80e7607b4430035251f249e3b03dd6 Mon Sep 17 00:00:00 2001 From: John Coffey Date: Mon, 21 Sep 2026 16:31:01 -0700 Subject: [PATCH] Publish with a builder on the host's network The first release's image never reached the registry. Both platforms built, then the push failed: failed to fetch oauth token: Post "https://git.coffeylabs.org/jwt/auth": dial tcp 172.30.0.2:443: connect: connection refused buildx's docker-container builder is a container of its own on the host's daemon, and it does the push, token and all. On the network it was created on, git.coffeylabs.org resolves to an internal address with nothing listening on 443. The job's own `docker login` worked because it goes through the host daemon, which resolves the name publicly. ihasmail's publish failed the same way this morning (job 513), so this is the runners, not this pipeline. The builder now runs on the host's network, so it resolves the name as the login does. Only the token request goes to git.coffeylabs.org; image layers still go to registry.coffeylabs.org, the registry's DNS-only name. It gets a new name, ci-builder-host: `ci-builder` is a long-lived container shared between jobs, and `create || use` would keep reusing it on its old network. --- .gitlab-ci.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index b070448..595d2d1 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -87,7 +87,16 @@ publish: echo "VERSION=$VERSION" > version.env - echo "$CI_REGISTRY_PASSWORD" | docker login -u "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY" - docker run --privileged --rm tonistiigi/binfmt --install arm64 - - docker buildx create --use --name ci-builder --driver docker-container || docker buildx use ci-builder + # The builder runs as a container on the host's daemon and does the push + # itself, including fetching a registry token from git.coffeylabs.org. + # On the runner's network that name resolves to an internal address + # (172.30.0.2) with nothing on 443, so the token request was refused and + # every push failed at the last step -- here and in ihasmail alike. On the + # host's network the name resolves as it does for `docker login` above. + # Only the token request uses it; layers still go to the registry's own + # DNS-only name. A new name, because `ci-builder` is a long-lived container + # shared between jobs and would keep whatever network it was created on. + - docker buildx create --use --name ci-builder-host --driver docker-container --driver-opt network=host || docker buildx use ci-builder-host script: - . ./version.env # Attestations are off, as they were in publish.yml: they add manifests of