From 95b10dcecc28817755544d35b2c136e9a36195a0 Mon Sep 17 00:00:00 2001
From: ChatGPT MCP <mcp-agent@itworx.tech>
Date: Fri, 28 Aug 2026 04:14:00 +0000
Subject: [PATCH] ci: add temporary runner Docker diagnostic

---
 .gitea/workflows/runner-docker-diagnostic.yml | 65 +++++++++++++++++++
 1 file changed, 65 insertions(+)
 create mode 100644 .gitea/workflows/runner-docker-diagnostic.yml

diff --git a/.gitea/workflows/runner-docker-diagnostic.yml b/.gitea/workflows/runner-docker-diagnostic.yml
new file mode 100644
index 00000000..00b3e6cb
--- /dev/null
+++ b/.gitea/workflows/runner-docker-diagnostic.yml
@@ -0,0 +1,65 @@
+name: Runner Docker diagnostic
+
+on:
+  push:
+    branches:
+      - chatgpt/geointel-hardening-20260826
+
+permissions:
+  contents: read
+
+jobs:
+  diagnostic:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Inspect isolated Docker executor connectivity
+        shell: bash
+        run: |
+          set -u
+          echo "DOCKER_HOST=${DOCKER_HOST:-<unset>}"
+          echo "DOCKER_TLS_VERIFY=${DOCKER_TLS_VERIFY:-<unset>}"
+          echo "DOCKER_CERT_PATH=${DOCKER_CERT_PATH:-<unset>}"
+          for socket_path in /var/run/docker.sock /run/user/1000/docker.sock /var/run/user/1000/docker.sock; do
+            if [[ -S "${socket_path}" ]]; then
+              echo "socket:${socket_path}=present"
+            else
+              echo "socket:${socket_path}=absent"
+            fi
+          done
+          cat /proc/net/route || true
+          python - <<'PY'
+          import socket
+          import struct
+          names = ("gitea-runner-dind", "docker", "host.docker.internal")
+          for name in names:
+              try:
+                  print(f"dns:{name}={socket.gethostbyname(name)}")
+              except OSError as exc:
+                  print(f"dns:{name}=unresolved:{type(exc).__name__}")
+          gateway = None
+          try:
+              with open("/proc/net/route", encoding="ascii") as handle:
+                  next(handle, None)
+                  for line in handle:
+                      fields = line.split()
+                      if len(fields) >= 3 and fields[1] == "00000000":
+                          gateway = socket.inet_ntoa(struct.pack("<L", int(fields[2], 16)))
+                          break
+          except OSError:
+              pass
+          if gateway:
+              print(f"default-gateway={gateway}")
+          hosts = ["gitea-runner-dind", "docker", "host.docker.internal"]
+          if gateway:
+              hosts.append(gateway)
+          for host in hosts:
+              for port in (2375, 2376):
+                  try:
+                      with socket.create_connection((host, port), timeout=1.0):
+                          print(f"tcp:{host}:{port}=reachable")
+                  except OSError as exc:
+                      print(f"tcp:{host}:{port}=unreachable:{type(exc).__name__}")
+          PY
+          docker version >/tmp/docker-version.txt 2>&1 || true
+          sed -n '1,40p' /tmp/docker-version.txt