ci: replace dnsmasq bridge with LAN forwarder in service resolv.conf 10.0.0.3 accepts queries from container-SNAT'd traffic (verified nested), so the dnsmasq relay is unnecessary.

69ece46980357fb9e9a3aa60e7bb887ed248b34f

permissionBRICK <christoph.ambrosch@live.at>

Parents: da42ffe22049a15fbd59c215756a715823adc2b9
1 files changed, +6 -4Showing whitespace changes
.gitlab-ci.yml+6 -4
@@ -7,10 +7,12 @@ build-image:
77 services:
88 - name: docker:dind
99 alias: docker
1010 # dnsmasqLAN bridgesblocks inner-direct container DNS toegress; the outerforwarder embeddedat resolver10.0.0.3
11- # (this LAN blocks direct DNS egress from containers); --bip avoids
11+ # (proxies to pihole) written into this service's resolv.conf is
12- # network collisions; --mtu clamps the inner bridge (PMTUD blackhole).
12+ # inherited by dind inner containers and BuildKit sandboxes (loopback
13- command: ["sh", "-c", "apk add --no-cache dnsmasq >/dev/null 2>&1; dnsmasq --bind-dynamic --listen-address=127.0.0.1 --listen-address=192.168.255.1 --port=53 --server=127.0.0.11 --no-resolv; echo 'nameserver 192.168.255.1' > /etc/resolv.conf; DOCKER_TLS_CERTDIR='' exec dockerd-entrypoint.sh --bip=192.168.255.1/24 --dns=192.168.255.1 --mtu=1400"]
13+ # entries would be stripped). --bip avoids network collisions; --mtu
14+ # clamps the inner bridge (PMTUD blackhole). Site-specific resolver.
15+ command: ["sh", "-c", "echo 'nameserver 10.0.0.3' > /etc/resolv.conf; DOCKER_TLS_CERTDIR='' exec dockerd-entrypoint.sh --bip=192.168.255.1/24 --mtu=1400"]
1416 variables:
1517 DOCKER_HOST: tcp://docker:2375
1618 script: