| 7 | 7 | services: |
| 8 | 8 | - name: docker:dind |
| 9 | 9 | alias: docker |
| 10 | | - # LAN blocks direct container DNS egress; the forwarder at 10.0.0.3 |
| 10 | + # DNS for nested containers comes from the runner's |
| 11 | | - # (proxies to pihole) written into this service's resolv.conf is |
| 11 | + # GITGUD_RUNNER_UPSTREAM_DNS. --bip avoids network collisions; --mtu |
| 12 | | - # inherited by dind inner containers and BuildKit sandboxes (loopback |
| 12 | + # clamps the inner bridge (PMTUD blackhole). |
| 13 | | - # entries would be stripped). --bip avoids network collisions; --mtu |
| 13 | + command: ["sh", "-c", "DOCKER_TLS_CERTDIR='' exec dockerd-entrypoint.sh --bip=192.168.255.1/24 --mtu=1400"] |
| 14 | | - # clamps the inner bridge (PMTUD blackhole). Site-specific resolver. |
| 15 | | - command: ["sh", "-c", "echo 'nameserver 10.0.0.3' > /etc/resolv.conf; DOCKER_TLS_CERTDIR='' exec dockerd-entrypoint.sh --bip=192.168.255.1/24 --mtu=1400"] |
| 16 | 14 | variables: |
| 17 | 15 | DOCKER_HOST: tcp://docker:2375 |
| 18 | 16 | script: |