fix(ci): drop ineffective --network host option, runner sets it globally now

2026-08-21 16:14:16 -07:00
parent aef122b854
commit 3d63df9ba8
1 changed files with 17 additions and 10 deletions
@@ -18,16 +18,23 @@ jobs:
    runs-on: docker
    container:
      image: docker:27-cli
-      # The runner's dind sidecar shares the pod network, so the daemon is
-      # reachable on localhost -- that part needs no extra config. The mTLS
-      # certs dind generates at startup do NOT come along for free, though:
-      # they live in an emptyDir mounted into the runner/dind containers, not
-      # into containers a workflow spins up. Job containers get no bind mounts
-      # at all unless the path is in the runner's container.valid_volumes
-      # allowlist (empty by default -- confirmed live, this exact mount was
-      # rejected until the runner's Helm chart added a config.yaml scoping
-      # valid_volumes to exactly this path).
-      options: --network host
+      # No `options: --network host` here -- act_runner ignores that per-job
+      # override and always decides the job container's network from its own
+      # config.yaml (container.network), which defaults to an isolated
+      # per-job bridge. Confirmed live: with that default, DOCKER_HOST=
+      # tcp://localhost:2376 resolved to the job container itself, not dind,
+      # so every command past `docker login` (which never touches DOCKER_HOST
+      # -- it only talks to the registry) failed with "Cannot connect to the
+      # Docker daemon". host networking is set once, for every job, in the
+      # runner's own Helm chart.
+      #
+      # The mTLS certs dind generates at startup are a separate gap: they
+      # live in an emptyDir mounted into the runner/dind containers, not into
+      # containers a workflow spins up. Job containers get no bind mounts at
+      # all unless the path is in the runner's container.valid_volumes
+      # allowlist (empty by default -- this exact mount was rejected until
+      # the runner's Helm chart added a config.yaml scoping valid_volumes to
+      # exactly this path).
      volumes:
        - /docker-certs/client:/docker-certs/client:ro
    env: