ci: replace dnsmasq bridge with LAN forwarder in service resolv.conf 10.0.0.3 accepts queries from container-SNAT'd traffic (verified nested), so the dnsmasq relay is unnecessary.

69ece46980357fb9e9a3aa60e7bb887ed248b34f

permissionBRICK <christoph.ambrosch@live.at>

Parents: da42ffe22049a15fbd59c215756a715823adc2b9
1 files changed, +6 -4Ignore whitespace
.gitlab-ci.yml+6 -4
@@ -7,10 +7,12 @@ build-image:
7 services:7 services:
8 - name: docker:dind8 - name: docker:dind
9 alias: docker9 alias: docker
10 # dnsmasq bridges inner-container DNS to the outer embedded resolver10 # LAN blocks direct container DNS egress; the forwarder at 10.0.0.3
11 # (this LAN blocks direct DNS egress from containers); --bip avoids11 # (proxies to pihole) written into this service's resolv.conf is
12 # network collisions; --mtu clamps the inner bridge (PMTUD blackhole).12 # inherited by dind inner containers and BuildKit sandboxes (loopback
13 command: ["sh", "-c", "apk add --no-cache dnsmasq >/dev/null 2>&1; dnsmasq --bind-dynamic --listen-address=127.0.0.1 --listen-address=192.168.255.1 --port=53 --server=127.0.0.11 --no-resolv; echo 'nameserver 192.168.255.1' > /etc/resolv.conf; DOCKER_TLS_CERTDIR='' exec dockerd-entrypoint.sh --bip=192.168.255.1/24 --dns=192.168.255.1 --mtu=1400"]13 # entries would be stripped). --bip avoids network collisions; --mtu
14 # clamps the inner bridge (PMTUD blackhole). Site-specific resolver.
15 command: ["sh", "-c", "echo 'nameserver 10.0.0.3' > /etc/resolv.conf; DOCKER_TLS_CERTDIR='' exec dockerd-entrypoint.sh --bip=192.168.255.1/24 --mtu=1400"]
14 variables:16 variables:
15 DOCKER_HOST: tcp://docker:237517 DOCKER_HOST: tcp://docker:2375
16 script:18 script: