Fetch the registry token from the public address, not the runner's

jcoffey-dev commented

2026-09-21 23:48:47 +00:00

Owner

The builder on the host's network (the last change here) didn't help: the
next publish failed exactly as before. Looking on the host showed why.
Both builders resolve git.coffeylabs.org publicly; the token isn't fetched
by the builder at all. buildx fetches registry tokens on the client side,
in the job container, and on ci-net the name git.coffeylabs.org belongs to
the gitlab container itself (172.30.0.2) -- which is how the runner clones
over plain HTTP, and which has nothing on 443. So every push asked
https://git.coffeylabs.org/jwt/auth for a token and was refused. The login
before it worked because the host's daemon does the login, and the host
resolves the name publicly.

For the publish job only, the name now points at its public address in the
job's /etc/hosts, looked up from a public resolver, as the host sees it.
/etc/hosts wins over Docker's DNS, and nothing else in the job is affected:
the checkout is done, and image layers go to the registry's own DNS-only
name, not this one. The builder goes back to the shared ci-builder; its
network was never the problem.

The lookup and the /etc/hosts write were tried in the job's own image
(docker:28-cli, same digest): it picks the first public IPv4 address and
getent then returns it.

The builder on the host's network (the last change here) didn't help: the next publish failed exactly as before. Looking on the host showed why. Both builders resolve git.coffeylabs.org publicly; the token isn't fetched by the builder at all. buildx fetches registry tokens on the client side, in the job container, and on ci-net the name git.coffeylabs.org belongs to the gitlab container itself (172.30.0.2) -- which is how the runner clones over plain HTTP, and which has nothing on 443. So every push asked https://git.coffeylabs.org/jwt/auth for a token and was refused. The login before it worked because the host's daemon does the login, and the host resolves the name publicly. For the publish job only, the name now points at its public address in the job's /etc/hosts, looked up from a public resolver, as the host sees it. /etc/hosts wins over Docker's DNS, and nothing else in the job is affected: the checkout is done, and image layers go to the registry's own DNS-only name, not this one. The builder goes back to the shared ci-builder; its network was never the problem. The lookup and the /etc/hosts write were tried in the job's own image (docker:28-cli, same digest): it picks the first public IPv4 address and getent then returns it.

jcoffey-dev commented

2026-09-21 23:48:47 +00:00

Author

Owner

assigned to @jcoffey-dev

jcoffey-dev commented

2026-09-22 01:20:30 +00:00

Author

Owner

mentioned in commit 2cd73c6705

mentioned in commit 2cd73c670566fcfc28a8046a1df1d5f015260897

jcoffey-dev merged commit 2cd73c6705 into main

2026-09-22 01:20:31 +00:00

Fetch the registry token from the public address, not the runner's #7