Fix managed ingress loopback publication

2026-08-03 19:28:10 +02:00
parent eb04804d36
commit 909862afdb
3 changed files with 43 additions and 2 deletions
@@ -176,6 +176,8 @@ Ingress acceptance streams generated configuration into Docker-managed
 volumes before starting the read-only containers. It therefore also works when
 an Actions job reaches a host or remote Docker daemon through a mounted socket;
 the drill never assumes that a job-container path is visible to that daemon.
+The drill allocates explicit loopback-only host ports and verifies Docker's
+published mappings, avoiding daemon-specific random-port shorthand behavior.
 The bounded setup helper writes only generated public configuration as root so
 it can initialize a new volume; the actual HAProxy process retains the image's
 non-root identity and runs read-only with all capabilities dropped.