From 3d63df9ba8e9f77b67c1e32ec7194de9fa5267ad Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Fri, 21 Aug 2026 16:14:16 -0700
Subject: [PATCH] fix(ci): drop ineffective --network host option, runner sets
 it globally now

---
 .gitea/workflows/build.yaml | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index 9d2213f..2f2391e 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -18,16 +18,23 @@ jobs:
     runs-on: docker
     container:
       image: docker:27-cli
-      # The runner's dind sidecar shares the pod network, so the daemon is
-      # reachable on localhost -- that part needs no extra config. The mTLS
-      # certs dind generates at startup do NOT come along for free, though:
-      # they live in an emptyDir mounted into the runner/dind containers, not
-      # into containers a workflow spins up. Job containers get no bind mounts
-      # at all unless the path is in the runner's container.valid_volumes
-      # allowlist (empty by default -- confirmed live, this exact mount was
-      # rejected until the runner's Helm chart added a config.yaml scoping
-      # valid_volumes to exactly this path).
-      options: --network host
+      # No `options: --network host` here -- act_runner ignores that per-job
+      # override and always decides the job container's network from its own
+      # config.yaml (container.network), which defaults to an isolated
+      # per-job bridge. Confirmed live: with that default, DOCKER_HOST=
+      # tcp://localhost:2376 resolved to the job container itself, not dind,
+      # so every command past `docker login` (which never touches DOCKER_HOST
+      # -- it only talks to the registry) failed with "Cannot connect to the
+      # Docker daemon". host networking is set once, for every job, in the
+      # runner's own Helm chart.
+      #
+      # The mTLS certs dind generates at startup are a separate gap: they
+      # live in an emptyDir mounted into the runner/dind containers, not into
+      # containers a workflow spins up. Job containers get no bind mounts at
+      # all unless the path is in the runner's container.valid_volumes
+      # allowlist (empty by default -- this exact mount was rejected until
+      # the runner's Helm chart added a config.yaml scoping valid_volumes to
+      # exactly this path).
       volumes:
         - /docker-certs/client:/docker-certs/client:ro
     env: