Docker Netfix B #2

2026-11-06T23:12:30+01:00

admin commented

2026-11-06 23:12:30 +01:00

No description provided.

admin added 1 commit 2026-11-06 23:12:30 +01:00

docker: pin tenant networks to 172.16.0.0/16 via explicit --subnet

ci / test (push) Successful in 35m1s

Details

4d3ea048a5

Tenant networks were created bare (docker network create <name>),
letting Docker's default pool hand out subnets outside the iptables
8889 allowlist (172.16.0.0/12). The smoke tenant landed on
192.168.32.0/20, so containers never reached the egress proxy and
every model turn timed out at 600s twice.

Fix (B): derive a deterministic /24 inside 172.16.0.0/16 from
sha256(network name) with linear probing on IPAM overlap, max 32
probes. 172.16.0.0/16 is the one /16 in the allowlist Docker never
auto-assigns (default pool starts at 172.17.0.0/16). No persistent
state; capacity 256 tenant networks per host, explicit failure when
exhausted. Pre-existing out-of-range networks are reused as-is and
need manual removal (see README).

Tests: 7 new (candidate properties incl. wrap-around, pinned argv,
overlap probe, exhaustion, empty name).

admin merged commit 834eced686 into main

2026-11-06 23:51:05 +01:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: admin/codex-app-server#2