A dev-base build that cannot reach download.docker.com reports 'unknown flag: --builder' #1411

New issue

Open

opened 2026-08-29 12:08:13 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-29 12:08:13 +00:00

Owner

Hit three times today across three pull requests, each spending ~15 minutes before failing.

What the log says, in order

curl: (35) Recv failure: Connection reset by peer     x6, ~2.5 min apart
unknown flag: --builder
Usage:  docker [OPTIONS] COMMAND [ARG...]
runner: exitcode '35': failure

What actually happened

install-docker.sh fetches the docker CLI and the buildx plugin from download.docker.com. Those six lines are its retry budget exhausting against an unreachable host.

With buildx never installed, the next step runs docker buildx build --builder against the plain docker CLI, which does not know --builder.

The reported error is a red herring. It names a flag and points at docker usage text, so it reads like a version skew or a bad argument in our own build graph. The real fact is six lines up and is network reachability. exitcode 35 is the only honest signal in the summary, and 35 is curl's rather than docker's.

Why it belongs in this milestone

Same class as the rest: the failure is loud but describes the wrong cause, so the first person to hit it debugs the build graph rather than the runner's egress. I checked my own diff before reading far enough up the log.

Measured

PR 1398, run 4354, failed after 15m22s, passed on a re-push. PR 1408, run 4391, failed after 15m25s. Intermittent, so the host is reachable some of the time.

What a fix could be

Fail with the real reason: have install-docker.sh exit non-zero naming the host it could not reach, rather than letting a later step fail on a missing plugin. Cheapest, and turns 15 minutes of wrong-tree debugging into one line.

Route the download through the egress proxy the way ci-command.sh does for other CI paths, if that is why it is unreachable.

Cache or vendor the buildx plugin, so a heavy image build does not depend on a third-party CDN.

The first is worth doing regardless, because it is the part that lies.

Hit three times today across three pull requests, each spending ~15 minutes before failing. ## What the log says, in order curl: (35) Recv failure: Connection reset by peer x6, ~2.5 min apart unknown flag: --builder Usage: docker [OPTIONS] COMMAND [ARG...] runner: exitcode '35': failure ## What actually happened install-docker.sh fetches the docker CLI and the buildx plugin from download.docker.com. Those six lines are its retry budget exhausting against an unreachable host. With buildx never installed, the next step runs docker buildx build --builder against the plain docker CLI, which does not know --builder. The reported error is a red herring. It names a flag and points at docker usage text, so it reads like a version skew or a bad argument in our own build graph. The real fact is six lines up and is network reachability. exitcode 35 is the only honest signal in the summary, and 35 is curl's rather than docker's. ## Why it belongs in this milestone Same class as the rest: the failure is loud but describes the wrong cause, so the first person to hit it debugs the build graph rather than the runner's egress. I checked my own diff before reading far enough up the log. ## Measured PR 1398, run 4354, failed after 15m22s, passed on a re-push. PR 1408, run 4391, failed after 15m25s. Intermittent, so the host is reachable some of the time. ## What a fix could be Fail with the real reason: have install-docker.sh exit non-zero naming the host it could not reach, rather than letting a later step fail on a missing plugin. Cheapest, and turns 15 minutes of wrong-tree debugging into one line. Route the download through the egress proxy the way ci-command.sh does for other CI paths, if that is why it is unreachable. Cache or vendor the buildx plugin, so a heavy image build does not depend on a third-party CDN. The first is worth doing regardless, because it is the part that lies.

coilyco-ops added the

autonomy

headless

priority

labels

2026-08-29 12:08:14 +00:00

coilyco-ops referenced this issue

2026-08-29 12:08:39 +00:00

A dev-base build that cannot reach download.docker.com reports the wrong error #1412