From 8bb1f7ae4d1f067fb111bbf7b4ec7e40fe019f31 Mon Sep 17 00:00:00 2001 From: Spencer McGuire Date: Sat, 17 Oct 2026 16:11:55 -0600 Subject: [PATCH] DEPLOY: docker-1 subnet pool limit broke the CI e2e job; note and the lasting fix Co-Authored-By: Claude Fable 5.1 --- docs/DEPLOY.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md index 5b8387b..e383823 100644 --- a/docs/DEPLOY.md +++ b/docs/DEPLOY.md @@ -172,6 +172,10 @@ Resolved 2026-10-17: the CA was switched to SHA-256 (`certutil -setreg ca\csp\CN The test stack on docker-1 lives under /home/spencerm/packetstation/test (stack.env, secrets/, ca/pesco-ca.pem, backups/) because the session that set it up had no sudo; move it to /etc/packetstation/test when convenient. +## Known issue: Docker subnet pool on docker-1 (found 2026-10-17) + +Docker's default address pool on docker-1 holds fifteen /16 bridge networks (172.17.0.0 to 172.31.0.0). Each compose stack takes one or two (Packet Station takes two: backend and egress), the Gitea runner takes one per job, and the CI e2e stack needs two more. With the test stack up the pool ran out and every e2e job failed within seconds with "all predefined address pools have been fully subnetted". Idle networks of stopped stacks were removed to make room. The lasting fix is a larger pool in /etc/docker/daemon.json, for example `{"default-address-pools":[{"base":"10.200.0.0/16","size":24}]}`, which needs sudo and a Docker restart (a short outage for every stack on the host), or trimming unused compose projects. When the production stack joins, count the networks first: `docker network ls --filter driver=bridge | wc -l`. + ## Doctor `packetstation doctor` proves a host and a stack are ready. Run it with `compose run`, not `compose exec`: the entrypoint exports MFILES_PASSWORD from its secret file, and `exec` skips the entrypoint, so the M-Files password check fails under `exec` even though the running worker has it.