Use an isolated network per Gitea Actions job #694

2026-11-03T16:47:11Z

raucao commented

2026-11-03 16:47:11 +00:00

Job containers were pinned to a single shared gitea-actions bridge network, added with the Actions cache to give service containers DNS resolution and a fixed gateway (172.20.0.1) for the built-in cache server. Because every job of every run attached to that one network, concurrent jobs' service containers collided on hostnames: two simultaneous jobs that both expose a redis service meant either could resolve the other's container, producing intermittent cross-job CI failures that disappeared when runs did not overlap.

This sets container.network back to empty so the runner auto-creates an isolated user-defined network per job. Embedded DNS still works on each per-job network, so service containers remain reachable by name, but jobs can no longer resolve each other's containers.

cache.host is left empty for auto-detection. The runner is a host binary (systemd), not containerized, so the detected address is reachable from job containers and the cache port stays fixed per runner. The cache firewall rule now allows Docker's default address pool (172.16.0.0/12) because per-job subnets are dynamic, and the now-unused gitea-actions network is removed on converge once idle.

Converged and verified on gitea-2: all three runner configs use an empty network/host, the gitea-actions network was removed, and the firewall shows 172.16.0.0/12. Still to validate with real jobs: two overlapping jobs that both use a redis service, and actions/cache (if a job logs getCacheEntry failed: connect ETIMEDOUT, set cache.host explicitly to the host's reachable IP).

Job containers were pinned to a single shared `gitea-actions` bridge network, added with the Actions cache to give service containers DNS resolution and a fixed gateway (`172.20.0.1`) for the built-in cache server. Because every job of every run attached to that one network, concurrent jobs' service containers collided on hostnames: two simultaneous jobs that both expose a `redis` service meant either could resolve the other's container, producing intermittent cross-job CI failures that disappeared when runs did not overlap. This sets `container.network` back to empty so the runner auto-creates an isolated user-defined network per job. Embedded DNS still works on each per-job network, so service containers remain reachable by name, but jobs can no longer resolve each other's containers. `cache.host` is left empty for auto-detection. The runner is a host binary (systemd), not containerized, so the detected address is reachable from job containers and the cache port stays fixed per runner. The cache firewall rule now allows Docker's default address pool (`172.16.0.0/12`) because per-job subnets are dynamic, and the now-unused `gitea-actions` network is removed on converge once idle. Converged and verified on gitea-2: all three runner configs use an empty network/host, the `gitea-actions` network was removed, and the firewall shows `172.16.0.0/12`. Still to validate with real jobs: two overlapping jobs that both use a `redis` service, and `actions/cache` (if a job logs `getCacheEntry failed: connect ETIMEDOUT`, set `cache.host` explicitly to the host's reachable IP).

raucao added 1 commit 2026-11-03 16:47:11 +00:00

Use an isolated network per Gitea Actions job 8a60ef2aea

Job containers were pinned to a single shared `gitea-actions` bridge
network, added with the Actions cache to give service containers DNS and a
fixed gateway for the built-in cache server. Because every job of every run
attached to that one network, concurrent jobs' service containers collided
on hostnames: two simultaneous jobs that both expose a `redis` service meant
either could resolve the other's container, causing intermittent cross-job
CI failures that vanished when runs did not overlap.

Set `container.network` back to empty so the runner auto-creates an isolated
user-defined network per job. Embedded DNS still works on each per-job
network, so service containers remain reachable by name, but jobs can no
longer resolve each other's containers.

`cache.host` is left empty for auto-detection; the runner here is a host
binary (systemd), not containerized, so the detected address is reachable
from job containers. The cache port stays fixed per runner. The cache
firewall rule now allows Docker's default address pool (172.16.0.0/12)
because per-job subnets are dynamic, and the now-unused `gitea-actions`
network is removed on converge once idle.

raucao added the

service

gitea

bug kredits-1 enhancement labels 2026-11-03 16:47:39 +00:00

raucao merged commit 11afecdff8 into chore/cinc

2026-11-03 16:48:05 +00:00

raucao deleted branch fix/gitea-actions-network

2026-11-03 16:48:05 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: kosmos/chef#694