From 2b82ce648440367f781f026d0d3dc076df7302bd Mon Sep 17 00:00:00 2001 From: enricobuehler Date: Thu, 30 Jul 2026 01:29:13 +0200 Subject: [PATCH] =?UTF-8?q?fix(ci/flatpak):=20host=20networking=20?= =?UTF-8?q?=E2=80=94=20ostree's=20resolver=20never=20worked=20through=20do?= =?UTF-8?q?cker's=20embedded=20DNS?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The flathub fetch has failed 10/10 retries for months, blamed on fleet load and DNS tuning. It is neither. Measured on home-runner-2, all inside ONE container: getent resolved dl.flathub.org, curl fetched the same URL with HTTP 200 (auto and -4), and flatpak still died '[6] Could not resolve hostname'. Rewriting resolv.conf to a real nameserver didn't help; the default bridge failed too; --network host works every time. So it is ostree's own resolver against Docker's embedded 127.0.0.11, and removing that resolver from the path is the fix. retry.sh stays as the backstop for genuine upstream blips. Co-Authored-By: Claude Fable 5 --- .gitea/workflows/flatpak.yml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/flatpak.yml b/.gitea/workflows/flatpak.yml index 7ec49f5e..7497c877 100644 --- a/.gitea/workflows/flatpak.yml +++ b/.gitea/workflows/flatpak.yml @@ -64,8 +64,19 @@ jobs: container: # Fedora ships a recent flatpak + flatpak-builder + the kernel userns support. # --privileged is required for bubblewrap inside the Docker executor (see header). + # + # --network host is what finally fixed the years-long "Could not resolve + # hostname" on every flathub fetch. MEASURED 2026-07-30 on home-runner-2, all + # in ONE container: `getent hosts dl.flathub.org` resolved, `curl` got HTTP + # 200 (both auto and -4), and flatpak still failed error [6] — so it was never + # DNS config, the resolver, the docker version, or the per-job network. It is + # ostree's own resolver refusing to work through Docker's embedded 127.0.0.11 + # (proven: rewriting resolv.conf to a real nameserver did NOT help, and the + # default bridge failed too, while the host netns — no embedded resolver in the + # path at all — works every time). Host networking also means this job no + # longer needs the nsswitch surgery below to be lucky. image: fedora:43 - options: --privileged + options: --privileged --network host steps: # DNS fix — MUST run before any network step. fedora:43's nsswitch.conf is # `hosts: files myhostname resolve [!UNAVAIL=return] dns`: the `resolve`