From 2846efb2a0f77ea5a18fa87892fd81f6f24b7a57 Mon Sep 17 00:00:00 2001
From: ChatGPT MCP <mcp-agent@itworx.tech>
Date: Fri, 28 Aug 2026 17:49:59 +0000
Subject: [PATCH] ci: test job-private Docker daemon

---
 .gitea/workflows/runner-docker-diagnostic.yml | 82 ++++++++-----------
 1 file changed, 35 insertions(+), 47 deletions(-)

diff --git a/.gitea/workflows/runner-docker-diagnostic.yml b/.gitea/workflows/runner-docker-diagnostic.yml
index 00b3e6cb..a655d783 100644
--- a/.gitea/workflows/runner-docker-diagnostic.yml
+++ b/.gitea/workflows/runner-docker-diagnostic.yml
@@ -11,55 +11,43 @@ permissions:
 jobs:
   diagnostic:
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 10
+    services:
+      docker:
+        image: docker@sha256:7c3e797187e43738220462658f4586572cbd3bf009f728b21e34d9c5c06ce431
+        env:
+          DOCKER_TLS_CERTDIR: ""
+        options: --privileged
+    env:
+      DOCKER_HOST: tcp://docker:2375
+      DOCKER_TLS_CERTDIR: ""
     steps:
-      - name: Inspect isolated Docker executor connectivity
+      - name: Verify job-private Docker daemon
         shell: bash
         run: |
-          set -u
-          echo "DOCKER_HOST=${DOCKER_HOST:-<unset>}"
-          echo "DOCKER_TLS_VERIFY=${DOCKER_TLS_VERIFY:-<unset>}"
-          echo "DOCKER_CERT_PATH=${DOCKER_CERT_PATH:-<unset>}"
-          for socket_path in /var/run/docker.sock /run/user/1000/docker.sock /var/run/user/1000/docker.sock; do
-            if [[ -S "${socket_path}" ]]; then
-              echo "socket:${socket_path}=present"
-            else
-              echo "socket:${socket_path}=absent"
+          set -euo pipefail
+          echo "DOCKER_HOST=${DOCKER_HOST}"
+          for attempt in $(seq 1 30); do
+            if docker info >/tmp/docker-info.txt 2>&1; then
+              break
             fi
+            if [[ "$attempt" -eq 30 ]]; then
+              cat /tmp/docker-info.txt
+              exit 1
+            fi
+            sleep 1
           done
-          cat /proc/net/route || true
-          python - <<'PY'
-          import socket
-          import struct
-          names = ("gitea-runner-dind", "docker", "host.docker.internal")
-          for name in names:
-              try:
-                  print(f"dns:{name}={socket.gethostbyname(name)}")
-              except OSError as exc:
-                  print(f"dns:{name}=unresolved:{type(exc).__name__}")
-          gateway = None
-          try:
-              with open("/proc/net/route", encoding="ascii") as handle:
-                  next(handle, None)
-                  for line in handle:
-                      fields = line.split()
-                      if len(fields) >= 3 and fields[1] == "00000000":
-                          gateway = socket.inet_ntoa(struct.pack("<L", int(fields[2], 16)))
-                          break
-          except OSError:
-              pass
-          if gateway:
-              print(f"default-gateway={gateway}")
-          hosts = ["gitea-runner-dind", "docker", "host.docker.internal"]
-          if gateway:
-              hosts.append(gateway)
-          for host in hosts:
-              for port in (2375, 2376):
-                  try:
-                      with socket.create_connection((host, port), timeout=1.0):
-                          print(f"tcp:{host}:{port}=reachable")
-                  except OSError as exc:
-                      print(f"tcp:{host}:{port}=unreachable:{type(exc).__name__}")
-          PY
-          docker version >/tmp/docker-version.txt 2>&1 || true
-          sed -n '1,40p' /tmp/docker-version.txt
+          docker version
+          initial_containers="$(docker ps -aq | wc -l)"
+          echo "initial-containers=${initial_containers}"
+          test "${initial_containers}" -eq 0
+
+          workdir="$(mktemp -d)"
+          printf 'geo-intel-ci\n' > "${workdir}/proof.txt"
+          cat > "${workdir}/Dockerfile" <<'EOF'
+          FROM scratch
+          COPY proof.txt /proof.txt
+          EOF
+          docker build --pull=false -t geointel-runner-diagnostic:local "${workdir}"
+          docker image inspect geointel-runner-diagnostic:local --format '{{.Id}}'
+          docker image rm geointel-runner-diagnostic:local >/dev/null