ci: test job-private Docker daemon

.gitea/workflows/runner-docker-diagnostic.yml

@@ -11,55 +11,43 @@ permissions:
 jobs:
   diagnostic:
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 10
+    services:
+      docker:
+        image: docker@sha256:7c3e797187e43738220462658f4586572cbd3bf009f728b21e34d9c5c06ce431
+        env:
+          DOCKER_TLS_CERTDIR: ""
+        options: --privileged
+    env:
+      DOCKER_HOST: tcp://docker:2375
+      DOCKER_TLS_CERTDIR: ""
     steps:
-      - name: Inspect isolated Docker executor connectivity
+      - name: Verify job-private Docker daemon
         shell: bash
         run: |
-          set -u
+          set -euo pipefail
-          echo "DOCKER_HOST=${DOCKER_HOST:-<unset>}"
+          echo "DOCKER_HOST=${DOCKER_HOST}"
-          echo "DOCKER_TLS_VERIFY=${DOCKER_TLS_VERIFY:-<unset>}"
+          for attempt in $(seq 1 30); do
-          echo "DOCKER_CERT_PATH=${DOCKER_CERT_PATH:-<unset>}"
+            if docker info >/tmp/docker-info.txt 2>&1; then
-          for socket_path in /var/run/docker.sock /run/user/1000/docker.sock /var/run/user/1000/docker.sock; do
+              break
-            if [[ -S "${socket_path}" ]]; then
-              echo "socket:${socket_path}=present"
-            else
-              echo "socket:${socket_path}=absent"
             fi
+            if [[ "$attempt" -eq 30 ]]; then
+              cat /tmp/docker-info.txt
+              exit 1
+            fi
+            sleep 1
           done
-          cat /proc/net/route || true
+          docker version
-          python - <<'PY'
+          initial_containers="$(docker ps -aq | wc -l)"
-          import socket
+          echo "initial-containers=${initial_containers}"
-          import struct
+          test "${initial_containers}" -eq 0
-          names = ("gitea-runner-dind", "docker", "host.docker.internal")
+
-          for name in names:
+          workdir="$(mktemp -d)"
-              try:
+          printf 'geo-intel-ci\n' > "${workdir}/proof.txt"
-                  print(f"dns:{name}={socket.gethostbyname(name)}")
+          cat > "${workdir}/Dockerfile" <<'EOF'
-              except OSError as exc:
+          FROM scratch
-                  print(f"dns:{name}=unresolved:{type(exc).__name__}")
+          COPY proof.txt /proof.txt
-          gateway = None
+          EOF
-          try:
+          docker build --pull=false -t geointel-runner-diagnostic:local "${workdir}"
-              with open("/proc/net/route", encoding="ascii") as handle:
+          docker image inspect geointel-runner-diagnostic:local --format '{{.Id}}'
-                  next(handle, None)
+          docker image rm geointel-runner-diagnostic:local >/dev/null
-                  for line in handle:
-                      fields = line.split()
-                      if len(fields) >= 3 and fields[1] == "00000000":
-                          gateway = socket.inet_ntoa(struct.pack("<L", int(fields[2], 16)))
-                          break
-          except OSError:
-              pass
-          if gateway:
-              print(f"default-gateway={gateway}")
-          hosts = ["gitea-runner-dind", "docker", "host.docker.internal"]
-          if gateway:
-              hosts.append(gateway)
-          for host in hosts:
-              for port in (2375, 2376):
-                  try:
-                      with socket.create_connection((host, port), timeout=1.0):
-                          print(f"tcp:{host}:{port}=reachable")
-                  except OSError as exc:
-                      print(f"tcp:{host}:{port}=unreachable:{type(exc).__name__}")
-          PY
-          docker version >/tmp/docker-version.txt 2>&1 || true
-          sed -n '1,40p' /tmp/docker-version.txt