From fb58720888434c54228b59c12e9812937cb0502f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=B6gl-Brunner=20Michel?= Date: Wed, 11 Nov 2026 16:24:38 +0100 Subject: [PATCH] arm-runner-setup: get past the runner's DNS failing for the arm64 mirror The ARM runner's resolver cannot resolve ports.ubuntu.com since this afternoon; apt then hangs. The name is now looked up over DNS-over-HTTPS when needed, and a failing apt prints the runner's network state. --- .github/workflows/scripts/arm-runner-setup.sh | 25 ++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/.github/workflows/scripts/arm-runner-setup.sh b/.github/workflows/scripts/arm-runner-setup.sh index 8786a7e5f..e3b33055a 100644 --- a/.github/workflows/scripts/arm-runner-setup.sh +++ b/.github/workflows/scripts/arm-runner-setup.sh @@ -37,7 +37,30 @@ printf '%s\n' 'Enabled: yes' 'Types: deb' 'URIs: https://pkgs.zabbly.com/incus/l # Each slow step has its own limit, so a hang names itself in the log instead # of holding the PR report until the job times out. step() { local t=$1; shift; timeout "$t" "$@" || { echo "::error::'$*' failed or hung (limit ${t})"; return 1; }; } -step 5m apt-get update -qq +# What the runner's network looks like when apt can't get through. +netdiag() { + echo "::group::Network on this runner" + resolvectl status 2>&1 | grep -E 'DNS Servers|Current DNS|resolv.conf mode' || cat /etc/resolv.conf + local h + for h in ports.ubuntu.com pkgs.zabbly.com github.com; do + echo "$h -> $(timeout 10 getent ahostsv4 "$h" | awk '{print $1; exit}')" + timeout 15 curl -s -o /dev/null -w " http %{http_code} in %{time_total}s\n" "http://$h/" || echo " no answer" + done + echo "::endgroup::" +} +# The runner's resolver (Azure's 168.63.129.16) stopped resolving the arm64 +# mirror on 2026-11-11 while every other name worked. Then the name is +# looked up over DNS-over-HTTPS and pinned in /etc/hosts for this job. +for h in ports.ubuntu.com; do + timeout 10 getent ahostsv4 "$h" >/dev/null && continue + ip=$(curl -fsS --max-time 10 -H 'accept: application/dns-json' "https://1.1.1.1/dns-query?name=$h&type=A" | + jq -r '[.Answer[]? | select(.type == 1) | .data][0] // empty') + if [[ "$ip" =~ ^[0-9]+(\.[0-9]+){3}$ ]]; then + echo "$ip $h" >>/etc/hosts + echo "::warning::the runner's DNS can't resolve $h; using $ip from 1.1.1.1" + fi +done +step 5m apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=30 update -qq || { netdiag; exit 1; } DEBIAN_FRONTEND=noninteractive step 10m apt-get install -y -qq incus jq >/dev/null # Docker on the runner sets the FORWARD policy to DROP, which cuts the Incus