Probe managed ingress across Docker namespaces

2026-08-03 19:41:04 +02:00
parent 909862afdb
commit 2f28f22fd1
4 changed files with 177 additions and 36 deletions
@@ -177,7 +177,10 @@ volumes before starting the read-only containers. It therefore also works when
 an Actions job reaches a host or remote Docker daemon through a mounted socket;
 the drill never assumes that a job-container path is visible to that daemon.
 The drill allocates explicit loopback-only host ports and verifies Docker's
-published mappings, avoiding daemon-specific random-port shorthand behavior.
+host binding configuration, avoiding daemon-specific random-port shorthand
+behavior. Because an Actions job and deployment containers may be Docker
+siblings, functional HTTP/TLS checks run from the digest-pinned API image on
+the deployment network instead of assuming the Docker host is job-local.
 The bounded setup helper writes only generated public configuration as root so
 it can initialize a new volume; the actual HAProxy process retains the image's
 non-root identity and runs read-only with all capabilities dropped.