From b4690a0a5e1ea4f9d09ca199652800e0c2fa11b2 Mon Sep 17 00:00:00 2001 From: emi Date: Tue, 21 Jul 2026 16:16:02 -0700 Subject: [PATCH] Fix CI boot check take 2: bridge IP is unreachable from the job container Curling the sibling container's own bridge-network IP (the previous fix) doesn't work on this runner -- docker-outside-of-docker means the job container's network namespace can't reach another container's bridge IP directly, so every curl attempt hung for the full ~130s TCP SYN timeout instead of failing fast (confirmed: a run got stuck for over 10 minutes on this). 127.0.0.1 does work here (the monorepo's own build.yml has published a host port successfully all along), so publish one again, but to a per-run PID-derived port instead of a fixed one, to still avoid the original port-collision problem. --- .forgejo/workflows/build.yml | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml index 1b87707..71e03d0 100644 --- a/.forgejo/workflows/build.yml +++ b/.forgejo/workflows/build.yml @@ -28,21 +28,27 @@ jobs: run: docker build -t thermograph-backend:ci . - name: Boot + health check - # No -p host-port publish and a unique-per-run container name (this + # Curling the sibling container's own bridge IP does NOT work on + # this runner (docker-outside-of-docker: the job container's network + # namespace can't reach another container's bridge IP directly -- + # every attempt hangs for the full TCP SYN timeout, ~130s, instead of + # failing fast) -- confirmed by a stuck run. 127.0.0.1 DOES work + # (proven by the monorepo's own build.yml, which has used a + # published host port successfully all along), so publish one, but + # to a per-run PID-derived port rather than a fixed one -- this # runner's snap-Docker install has a known AppArmor bug denying - # docker stop/kill -- a leftover container from a prior failed run - # would otherwise permanently squat a fixed host port and block - # every subsequent run too). Curl the container's own bridge-network - # IP directly instead. + # docker stop/kill, so a leftover container from any prior failed + # run permanently squats whatever host port it was given, and a + # fixed port would block every subsequent run too. run: | name="backend-ci-$$" + port=$((18000 + ($$ % 1000))) docker run -d --name "$name" \ -e THERMOGRAPH_FRONTEND_BASE_INTERNAL=http://127.0.0.1:1 \ - thermograph-backend:ci - ip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$name") + -p "127.0.0.1:${port}:8137" thermograph-backend:ci ok=0 for i in $(seq 1 30); do - if curl -fsS -o /dev/null "http://${ip}:8137/healthz"; then ok=1; break; fi + if curl -fsS -o /dev/null "http://127.0.0.1:${port}/healthz"; then ok=1; break; fi sleep 1 done docker logs "$name"