- Add host-level AAAA DNS sanity test against CoreDNS
- Fail hard on SERVFAIL (breaks Node/getaddrinfo with EAI_AGAIN)
- Allow empty AAAA responses (IPv4-only setup is valid)
- Keep A-record validation unchanged
This prevents silent IPv6 resolver regressions that break CSP checks.
https://chatgpt.com/share/696abc27-19dc-800f-9ead-6598c2f3c302
sys-svc-docker role as a post-restart validation handler.
This change moves the inner-container DNS validation out of the CI test
suite and into the Docker service lifecycle itself, ensuring that DNS is
verified exactly where it matters: inside the Docker-in-Docker daemon.
Key changes:
- Add roles/sys-svc-docker/files/test-dns.sh:
- Runs inside the DinD container
- Waits for dockerd readiness
- Executes a BusyBox test container with explicit --dns
- Verifies DOMAIN and subdomain resolve to the expected IP
- Fails hard if DNS is broken
- Register DNS self-test as a docker restart handler:
- Runs once per deployment
- Only executed when DOCKER_IN_CONTAINER and MODE_DEBUG are enabled
- Uses ansible.builtin.script with role_path for correct resolution
- Remove inner Docker DNS test from scripts/tests/dns.sh:
- CI test suite now only validates host → CoreDNS → outer container chain
- DinD DNS validation is now part of the Docker service health lifecycle
This ensures that:
- DNS is validated after every Docker restart
- DinD networking failures are detected immediately
- CI and production share the same DNS validation logic
- Docker-in-Docker DNS becomes a first-class health invariant
https://chatgpt.com/share/696a3dda-5c6c-800f-8a16-47c0c604e1e3
- Quote dig server argument to avoid word splitting (SC2086)
- Replace &&/|| pseudo-if with proper if/else blocks (SC2015)
- Validate INFINITO_CONTAINER early via required env guard
- Keep DNS test logic unchanged, only harden correctness and linting
This makes scripts/tests/dns.sh fully shellcheck -x compliant and more robust.
https://chatgpt.com/share/696a4053-93f8-800f-959b-f99e2d7d12e2
- Introduce env.ci as single source of truth for CI networking
- Make docker-compose, CoreDNS and Docker daemon fully env-driven
- Render CoreDNS Corefile from template via envsubst
- Replace hardcoded IPs/domains with environment variables
- Integrate env-based networking into Ansible defaults
- Remove static Corefile and daemon.json
This makes DNS and networking deterministic and reproducible across
host, CoreDNS, infinito runner and Docker-in-Docker.
https://chatgpt.com/share/696a3dda-5c6c-800f-8a16-47c0c604e1e3
kevinveenbirkenbach