CI steps run inside Docker containers on the wp-agents, and Docker gives
containers no IPv6 by default — so deploys to IPv6-only hosts fail with
"Network unreachable" even when the agent host itself has v6 (confirmed:
the deploy-netbird-proxy pipeline can't SSH the v6-only proxy-1).
Write /etc/docker/daemon.json with ipv6 + a ULA fixed-cidr-v6 + ip6tables
(IPv6 NAT), so step containers get NAT'd v6 egress through the host.
Caveats:
- Requires Docker 27+ (ip6tables stable) and the agent HOSTS to have v6
egress themselves (the .srv VLAN must route v6).
- Applying notifies a docker restart, which interrupts running pipelines
(including the one applying it, if run via a pipeline on the agents).
Apply deliberately — out-of-band, or expect the triggering run to die on
the restart and re-run it.
Unblocks the deploy-netbird-proxy pipeline (PR #47) reaching proxy-1.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
k.rennerandClaude Opus 4.8