oblachno-oss/grm
3
0
Fork 0
Code Issues 33 Pull Requests Actions Packages Projects Releases 22 Wiki Activity

fix: switch default network driver to slirp4netns (pasta TCP RST bug)

Browse Source 
pasta's TCP proxy sends RST packets with wrong sequence numbers after
the first data packet, breaking TCP connections from Docker containers
to external hosts. slirp4netns doesn't have this bug.

Changes:
- Default gitea_runner_docker_rootless_net_driver changed to slirp4netns
- Port driver: 'implicit' for pasta, 'builtin' for slirp4netns
- daemon.json: DNS configured per driver (10.0.2.3 for pasta, 8.8.8.8 for slirp4netns)
- IPv6 only enabled for pasta (slirp4netns doesn't support IPv6)
- integration_test: retry service active check (handles slow startup)
This commit is contained in:
Emil Simeonov
2026-08-04 10:28:02 +02:00
parent d0d28657f5
commit 7cf6ce9afb
17 changed files with 192 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/roles/gitea_runner/defaults/main.yml
+6 -3
View File
@@ -64,9 +64,12 @@ gitea_runner_rootless_scripts_ref: "v28.5.1"
# that dockerd-rootless-setuptool.sh (which derives BIN from its own dirname) finds them co-located.
gitea_runner_rootless_scripts_install_dir: "/usr/bin"
# Rootless Docker network driver: "pasta" (IPv6 support) or "slirp4netns" (IPv4 only)
# pasta has proper outgoing IPv6 support; slirp4netns does not (known limitation).
gitea_runner_docker_rootless_net_driver: "pasta"
# Rootless Docker network driver: "slirp4netns" (default) or "pasta" (IPv6 support)
# slirp4netns is the default because pasta has a TCP proxy bug that sends RST
# packets with wrong sequence numbers, breaking TCP connections from Docker
# containers to external hosts. slirp4netns doesn't have IPv6 support.
# See: https://bugs.passt.top/show_bug.cgi?id=52
gitea_runner_docker_rootless_net_driver: "slirp4netns"
# IPv6 subnet for rootless Docker containers (ULA range, not routable on internet)
gitea_runner_docker_ipv6_cidr: "fd00:dead:beef::/48"