From 5d16b5713dce1ea24952e54319ec714a77eee488 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Tue, 8 Sep 2026 15:30:27 -0700 Subject: [PATCH] Give BuildKit the host's network, so it can reach the runner's cache MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The multi-arch build needs the `docker-container` driver — the plain `docker` driver cannot do linux/amd64+linux/arm64 — and that driver runs BuildKit in its own container on Docker's default bridge. act_runner advertises ACTIONS_CACHE_URL as an address the *job* container can reach, and nothing teaches the BuildKit container about it. So the job could reach 192.168.1.126:40649 while the container actually making the cache request could not. That is also why no other workflow here hit this: it is the only one using buildx. The rest make their cache calls from the job container act_runner set up. `no route to host` is EHOSTUNREACH — a firewall rejecting, not a missing route — which is what a default firewalld zone does to traffic from the docker bridge, and the runner registers under the stock RHEL/Fedora hostname. Sharing the host's namespace sidesteps it: the cache address becomes local to BuildKit. No effect on runners where this already worked. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_0145mQi9NZiCDrznBUEEDE4n --- .gitea/workflows/build.yml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index f69cb99..3c3d8dc 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -28,6 +28,27 @@ jobs: - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 + with: + # Put BuildKit in the host's network namespace so it can reach + # act_runner's cache service. + # + # The `docker-container` driver — which the multi-arch build below + # requires, since the plain `docker` driver cannot do + # linux/amd64+linux/arm64 — runs BuildKit in its *own* container on + # Docker's default bridge. act_runner advertises ACTIONS_CACHE_URL as + # an address the *job* container can reach, and nothing teaches the + # BuildKit container about it: the job could reach + # 192.168.1.126:40649 while the container actually making the request + # could not, and the build died with `no route to host`. + # + # `no route to host` is EHOSTUNREACH — a firewall rejecting, not a + # missing route (a wrong address times out instead) — which is what a + # default firewalld zone does to traffic arriving from the docker + # bridge. Sharing the host's namespace sidesteps the question + # entirely: the cache address becomes local to BuildKit. + # + # No effect on runners where this already worked. + driver-opts: network=host - name: Login to Gitea Container Registry uses: docker/login-action@v3