修复 Gitea runner 的 DinD MTU

2026-09-10 07:30:09 +00:00
parent 5539793e10
commit 33627573c3
3 changed files with 12 additions and 0 deletions
@@ -7,6 +7,12 @@ would still be privileged and is blocked by the node's AppArmor user-namespace
 policy, so this deployment uses regular DinD instead of weakening that host-wide
 policy. Only trusted workflows may target this runner.

+DinD 显式使用 `--mtu=1450`，与 k3s Pod 的 `eth0` 一致。不要在未验证节点 Pod
+MTU 的情况下删除或修改它：DinD 默认创建 MTU 1500 的 Actions bridge，容器虽然
+能够解析 GitHub、甚至建立 TCP 连接，但较大的 TLS 数据包会在嵌套网络路径中丢失，
+表现为 `github.com` / `api.github.com` 超时。Pod 网络和 `--network host` 正常不代表
+job bridge 正常。
+
 The runner is registered at instance scope so it is available to every repository
 on this Gitea instance. Repository permissions and protected-branch review are
 therefore the security boundary; do not enable Actions for untrusted repositories.