From 4d6274bb8fcd61886475a2b098ff5c6c2b42c937 Mon Sep 17 00:00:00 2001 From: panxiao81 Date: Thu, 10 Sep 2026 07:55:39 +0000 Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20Actions=20=E5=8A=A8?= =?UTF-8?q?=E6=80=81=E7=BD=91=E7=BB=9C=E7=9A=84=20MTU?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- platform/gitea-runner/README.md | 13 ++++++++----- platform/gitea-runner/values.yaml | 3 +++ 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/platform/gitea-runner/README.md b/platform/gitea-runner/README.md index 2d0382c..3b7895e 100644 --- a/platform/gitea-runner/README.md +++ b/platform/gitea-runner/README.md @@ -7,11 +7,14 @@ would still be privileged and is blocked by the node's AppArmor user-namespace policy, so this deployment uses regular DinD instead of weakening that host-wide policy. Only trusted workflows may target this runner. -DinD 显式使用 `--mtu=1450`，与 k3s Pod 的 `eth0` 一致。不要在未验证节点 Pod -MTU 的情况下删除或修改它：DinD 默认创建 MTU 1500 的 Actions bridge，容器虽然 -能够解析 GitHub、甚至建立 TCP 连接，但较大的 TLS 数据包会在嵌套网络路径中丢失， -表现为 `github.com` / `api.github.com` 超时。Pod 网络和 `--network host` 正常不代表 -job bridge 正常。 +DinD 同时使用 `--mtu=1450` 和 +`--default-network-opt=bridge=com.docker.network.driver.mtu=1450`，与 k3s Pod 的 +`eth0` 一致。前者只覆盖 Docker 默认 bridge；act 为每个 job 创建 user-defined +bridge，必须由后者设置默认 MTU。不要在未验证节点 Pod MTU 的情况下删除或修改这 +两个参数：MTU 1500 的 job 容器虽然能够解析 GitHub、甚至建立 TCP 连接，但较大的 +TLS 数据包会在嵌套网络路径中丢失，表现为 `github.com` / `api.github.com` 超时或 +`setup-go` 每次请求卡满 6 分钟后重试。Pod 网络和默认 Docker bridge 正常不代表 +Actions job bridge 正常。 The runner is registered at instance scope so it is available to every repository on this Gitea instance. Repository permissions and protected-branch review are diff --git a/platform/gitea-runner/values.yaml b/platform/gitea-runner/values.yaml index 107df4c..4f258a8 100644 --- a/platform/gitea-runner/values.yaml +++ b/platform/gitea-runner/values.yaml @@ -56,3 +56,6 @@ statefulset: # overlay path while direct pod traffic remains healthy. extraArgs: - --mtu=1450 + # --mtu only changes Docker's default bridge. act creates a user-defined + # bridge per job, so give every new bridge the same explicit default. + - --default-network-opt=bridge=com.docker.network.driver.mtu=1450