Docker executor create networks with Options -> Isolated = true when using FF_NETWORK_PER_BUILD

GitLab CI/CD
, ,
1

Hi, team!
I’m experience interesting behavior when using FF_NETWORK_PER_BUILD = True - executor force advanced network option “Isolated = true” on temporary build-related networks.

If i’m manually create network with podman network create <network_name> - this option is absent when i’m inspecting a network.

So it added by executor when job are started. And i unable to find any options to handle this behavior. (Docker executor | GitLab).

This behavior prevent network interaction between service containers, but this communication is required to startup the app.

OS: RHEL9.3
Gitlab runner: 16.10.0-1
Podman version: 4.6.1

How i can force Isolate=False in CI/CD Job ?

Thanks

[
     {
          "name": "runner-esc7ss3wb-project-60-concurrent-0-job-1099-network",
          "id": "df0f75c733ee880c4eedd4f3f85cf0ee4dc69276f4784a1ba1e9cd866a3354c5",
          "driver": "bridge",
          "network_interface": "podman3",
          "created": "2024-04-16T13:38:48.976241844+03:00",
....
          "ipv6_enabled": false,
          "internal": false,
          "dns_enabled": true,
          "labels": {
               "com.gitlab.gitlab-runner.job.before_sha": "814c40cc9cb6f3d89c2199285e0e65ae5a8e9904",
               "com.gitlab.gitlab-runner.job.id": "1099",
               "com.gitlab.gitlab-runner.job.ref": "main",
               "com.gitlab.gitlab-runner.job.sha": "2a60c0d9346a479fcc3d522bfc913d8a6d55b13d",
               "com.gitlab.gitlab-runner.managed": "true",
               "com.gitlab.gitlab-runner.pipeline.id": "575",
               "com.gitlab.gitlab-runner.project.id": "60",
               "com.gitlab.gitlab-runner.runner.id": "ESC7Ss3wB",
               "com.gitlab.gitlab-runner.runner.local_id": "0"
          },
          **"options": {**
**               "isolate": "true"**
          },
          "ipam_options": {
               "driver": "host-local"
          }
     }
]
2

Hi Slava! If you need communicate between pods inside isolated docker network try:

  • use docker link option during CI application setup phase.
    During application setup/upgrade change nft-table options, because this way docker or podman provide pod isolation
3

Its legacy feature.

4

This is false positive problem: everything work as expected.
Problem origin wrong resulting variables values and our application error handling.