woodpecker-agent: enable IPv6 in the Docker daemon (so CI can reach v6 hosts) #48

2026-06-26T11:50:31Z

k.renner commented

2026-06-26 11:50:31 +00:00

CI steps run inside Docker containers on the wp-agent hosts, and Docker gives containers no IPv6 by default — so even though the agents have v6 egress, step-containers do not, and deploys to IPv6-only hosts fail with Network unreachable. Confirmed: the deploy-netbird-proxy pipeline (PR #47) cannot SSH the v6-only proxy-1 (connect to ... port 22: Network unreachable).

Writes /etc/docker/daemon.json on the agents with ipv6 + a ULA fixed-cidr-v6 + ip6tables (IPv6 NAT), so step-containers get NAT'd v6 egress through the host's existing v6.

Apply

Requires Docker 27+ (ip6tables stable). Applying restarts Docker on the agents → interrupts running pipelines, and there is no agent-deploy pipeline by design (you can't restart Docker on the agents from the agents). Apply out-of-band: ansible-playbook -i inventory/ plays/install-woodpecker-agent.yml, draining the agents first.

Unblocks deploy-netbird-proxy (PR #47) reaching proxy-1. Merge order: this first (+ apply), then PR #47.

🤖 Generated with Claude Code

CI steps run inside Docker containers on the `wp-agent` hosts, and **Docker gives containers no IPv6 by default** — so even though the agents have v6 egress, step-containers do not, and deploys to IPv6-only hosts fail with `Network unreachable`. Confirmed: the `deploy-netbird-proxy` pipeline (PR #47) cannot SSH the v6-only `proxy-1` (`connect to ... port 22: Network unreachable`). Writes `/etc/docker/daemon.json` on the agents with `ipv6` + a ULA `fixed-cidr-v6` + `ip6tables` (IPv6 NAT), so step-containers get NAT'd v6 egress through the host's existing v6. ### Apply Requires Docker 27+ (ip6tables stable). Applying **restarts Docker** on the agents → interrupts running pipelines, and there is no agent-deploy pipeline by design (you can't restart Docker on the agents from the agents). Apply out-of-band: `ansible-playbook -i inventory/ plays/install-woodpecker-agent.yml`, draining the agents first. **Unblocks** `deploy-netbird-proxy` (PR #47) reaching `proxy-1`. Merge order: this first (+ apply), then PR #47. 🤖 Generated with Claude Code

k.renner added 1 commit 2026-06-26 11:50:31 +00:00

woodpecker-agent: enable IPv6 in the Docker daemon f0252a8b94

CI steps run inside Docker containers on the wp-agents, and Docker gives
containers no IPv6 by default — so deploys to IPv6-only hosts fail with
"Network unreachable" even when the agent host itself has v6 (confirmed:
the deploy-netbird-proxy pipeline can't SSH the v6-only proxy-1).

Write /etc/docker/daemon.json with ipv6 + a ULA fixed-cidr-v6 + ip6tables
(IPv6 NAT), so step containers get NAT'd v6 egress through the host.

Caveats:
- Requires Docker 27+ (ip6tables stable) and the agent HOSTS to have v6
  egress themselves (the .srv VLAN must route v6).
- Applying notifies a docker restart, which interrupts running pipelines
  (including the one applying it, if run via a pipeline on the agents).
  Apply deliberately — out-of-band, or expect the triggering run to die on
  the restart and re-run it.

Unblocks the deploy-netbird-proxy pipeline (PR #47) reaching proxy-1.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

k.renner merged commit d1005aba64 into master

2026-06-26 11:57:56 +00:00

k.renner referenced this issue from a commit

2026-06-26 11:57:57 +00:00

Merge pull request 'woodpecker-agent: enable IPv6 in the Docker daemon (so CI can reach v6 hosts)' (#48) from ci-agent-ipv6 into master

k.renner referenced this pull request

2026-06-26 12:08:39 +00:00

ci: add deploy-woodpecker-agent pipeline #50

k.renner referenced this issue from a commit

2026-06-26 12:08:40 +00:00

ci: add deploy-woodpecker-agent pipeline

k.renner referenced this issue from a commit