Make the docker probe report on the daemon the build chose #798

Merged

coilysiren merged 1 commit from aos/claude/xh55-docker-probe into main

2026-08-15 15:36:19 +00:00

coilyco-ops commented

2026-08-15 15:28:20 +00:00

Member

Closes #787.

scripts/ci-docker-probe.sh runs only when image-build fails and exists to explain that failure. Two things stopped it.

It called a command the image does not have. ip is absent from agentic-os:release, so every run printed a command-not-found line and fell through to the raw /proc/net/route table, leaving the reader to decode 010012AC to 172.18.0.1 by hand. The probe now prints the decoded gateway.

It did not test the address the build uses. ci-image-build.sh inserts the derived bridge gateway ahead of the hardcoded 172.17.0.1, and the probe never tried it. One run built against 172.18.0.1, which the probe would have skipped, while the probe did try localhost and host.docker.internal, which the build never tries. Both scripts now read one list from scripts/lib/docker-host.sh.

It read like an outage when nothing was down. The probe fires on any image-build failure, and most are Dockerfile faults. Run 945 reached step 26 of 40 against a healthy daemon and its probe output still listed unreachable candidates. The build now records the address it resolved, and the probe leads with that record.

On closing it out instead

#91 is closed, so the header's "temporary" no longer holds either way. Keeping the probe: it is the only diagnostic image-build has when the daemon is genuinely unreachable, and the bridge has renumbered under it once already. The header stops calling it temporary.

Verification

Both paths exercised locally with a stubbed docker: resolution success writes the record and the probe leads with it, resolution failure writes nothing and the probe says so.
Candidate ordering and the little-endian decode checked against a fixture route table (010012AC to 172.18.0.1).
pre-commit run --all-files and ward exec test-skips pass.
The daemon path itself is unverifiable off the runner. The first image-build run on this PR is the real check.

Closes #787. `scripts/ci-docker-probe.sh` runs only when `image-build` fails and exists to explain that failure. Two things stopped it. **It called a command the image does not have.** `ip` is absent from `agentic-os:release`, so every run printed a command-not-found line and fell through to the raw `/proc/net/route` table, leaving the reader to decode `010012AC` to `172.18.0.1` by hand. The probe now prints the decoded gateway. **It did not test the address the build uses.** `ci-image-build.sh` inserts the derived bridge gateway ahead of the hardcoded `172.17.0.1`, and the probe never tried it. One run built against `172.18.0.1`, which the probe would have skipped, while the probe did try `localhost` and `host.docker.internal`, which the build never tries. Both scripts now read one list from `scripts/lib/docker-host.sh`. **It read like an outage when nothing was down.** The probe fires on any `image-build` failure, and most are Dockerfile faults. Run 945 reached step 26 of 40 against a healthy daemon and its probe output still listed unreachable candidates. The build now records the address it resolved, and the probe leads with that record. ## On closing it out instead #91 is closed, so the header's "temporary" no longer holds either way. Keeping the probe: it is the only diagnostic `image-build` has when the daemon is genuinely unreachable, and the bridge has renumbered under it once already. The header stops calling it temporary. ## Verification - Both paths exercised locally with a stubbed `docker`: resolution success writes the record and the probe leads with it, resolution failure writes nothing and the probe says so. - Candidate ordering and the little-endian decode checked against a fixture route table (`010012AC` to `172.18.0.1`). - `pre-commit run --all-files` and `ward exec test-skips` pass. - The daemon path itself is unverifiable off the runner. The first `image-build` run on this PR is the real check.

coilyco-ops added 1 commit

2026-08-15 15:28:20 +00:00

fix(ci): make the docker probe report on the daemon the build chose

ci / test (pull_request) Successful in 38s

Details

ci / publish-echo-image (pull_request) Has been skipped

Details

ci / publish-observed (pull_request) Has been skipped

Details

ci / image-build (pull_request) Successful in 3m56s

Details

07398d3b00

The probe runs only when image-build fails and exists to explain that failure.
It could not, for two reasons.

It called `ip`, which is not in agentic-os:release, so every run printed a
command-not-found line and fell through to the raw /proc/net/route table. That
left the reader decoding 010012AC to 172.18.0.1 by hand, which is exactly the
arithmetic ci-image-build.sh already does. The probe now prints the decoded
gateway.

More importantly, its candidate list was hardcoded and diverged from the build's
own. ci-image-build.sh inserts the derived bridge gateway ahead of the
hardcoded 172.17.0.1, and the probe never tested that address. One run built
against 172.18.0.1 the probe would not have tried, while the probe did try
localhost and host.docker.internal, which the build never tries. Both scripts
now read one list from scripts/lib/docker-host.sh, so the probe can neither
report on an address the build would skip nor miss the one it chose.

The probe also fires on any image-build failure, and most of those are
Dockerfile faults rather than daemon faults. Run 945 reached step 26 of 40 with
a healthy daemon, and its probe output still read like a partial outage. The
build now records the address it resolved and the probe leads with that record,
so a Dockerfile fault says so in the first two lines.

The header called the script temporary, for #91. That issue closed, but the
probe is the only diagnostic the job has when the daemon is genuinely
unreachable and the bridge can renumber under it, so it stays and the header
stops calling it temporary.

Closes #787

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Angie <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>

coilyco-ops requested review from coilysiren

2026-08-15 15:28:20 +00:00