mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbach
6660b45605
container_dns decides per host whether containers get the docker bridge
or the clearnet resolver, and this host gets the clearnet one: daemon.json
carries 172.30.0.53, and nothing listens on the bridge gateway. The probe
read that gateway from the running daemon and forced the test container
onto it with --dns, so it answered 'Connection refused' against a daemon
that was resolving correctly, and the deploy died in the infrastructure
phase before any role ran.
Dropping the override lets the container take what every app container
takes. That measures the real path in both topologies - the cluster nodes
where the daemon does hand out the bridge, and here.
ce43263745 replaced a stale inventory literal with this runtime lookup
and kept its assumption that the gateway is the resolver at all.
97 lines
2.6 KiB
Bash
97 lines
2.6 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# ------------------------------------------------------------
|
|
# Optional env overrides (with safe defaults)
|
|
# ------------------------------------------------------------
|
|
: "${BUSYBOX_IMAGE:?Missing Busybox image}"
|
|
: "${NODE_IMAGE?Missing Node image; pass it empty to skip the getaddrinfo check}"
|
|
|
|
: "${DOMAIN:?Missing env DOMAIN}"
|
|
|
|
SUBDOMAIN="foo.${DOMAIN}"
|
|
|
|
section() {
|
|
echo
|
|
echo "------------------------------------------------------------"
|
|
echo "$1"
|
|
echo "------------------------------------------------------------"
|
|
}
|
|
|
|
ok() { echo "OK: $*"; }
|
|
fail() { echo "FAIL: $*"; exit 1; }
|
|
|
|
section "Wait for dockerd (DinD)"
|
|
|
|
for i in $(seq 1 60); do
|
|
if [ -S /var/run/docker.sock ] && container info >/dev/null 2>&1; then
|
|
ok "dockerd ready"
|
|
break
|
|
fi
|
|
echo "waiting for dockerd... (${i}/60)" >&2
|
|
sleep 1
|
|
done
|
|
|
|
[ -S /var/run/docker.sock ] || fail "docker.sock missing after waiting"
|
|
container info >/dev/null 2>&1 || fail "container info still failing after waiting"
|
|
|
|
section "Docker-in-Docker DNS (busybox: A + no SERVFAIL)"
|
|
|
|
container run --rm "${BUSYBOX_IMAGE}" sh -lc "
|
|
set -e
|
|
|
|
test_lookup_a() {
|
|
name=\"\$1\"
|
|
out=\$(nslookup \"\$name\" 2>&1 || true)
|
|
echo \"\$out\"
|
|
echo \"\$out\" | grep -qE \"^Address: [0-9]\" || {
|
|
echo \"A lookup returned no address for \$name\"
|
|
exit 1
|
|
}
|
|
}
|
|
|
|
# We don't require AAAA, but we must never see SERVFAIL (that broke Node/getaddrinfo).
|
|
test_lookup_no_servfail() {
|
|
name=\"\$1\"
|
|
out=\$(nslookup \"\$name\" 2>&1 || true)
|
|
echo \"\$out\"
|
|
if echo \"\$out\" | grep -q \"SERVFAIL\"; then
|
|
echo \"DNS lookup returned SERVFAIL for \$name\"
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
test_lookup_a \"${DOMAIN}\"
|
|
test_lookup_a \"${SUBDOMAIN}\"
|
|
|
|
test_lookup_no_servfail \"${DOMAIN}\"
|
|
test_lookup_no_servfail \"${SUBDOMAIN}\"
|
|
"
|
|
|
|
ok "Inner container DNS works (A present; no SERVFAIL)"
|
|
|
|
if [ -z "${NODE_IMAGE}" ]; then
|
|
section "Docker-in-Docker DNS (node/getaddrinfo): skipped, NODE_IMAGE is empty"
|
|
else
|
|
section "Docker-in-Docker DNS (node/getaddrinfo)"
|
|
|
|
container run --rm "${NODE_IMAGE}" sh -lc "
|
|
set -e
|
|
node -e \"
|
|
const dns = require('dns');
|
|
dns.lookup('${DOMAIN}', { all: true }, (e, a) => {
|
|
console.log('err', e && e.code, e && e.message);
|
|
console.log('addrs', a);
|
|
process.exit(e ? 1 : 0);
|
|
});
|
|
\"
|
|
"
|
|
|
|
ok "Node/getaddrinfo DNS works"
|
|
fi
|
|
|
|
echo
|
|
echo "============================================================"
|
|
echo "DNS health check completed successfully."
|
|
echo "============================================================"
|