feat(container): add an explicit private worker build network #39

Merged

gitchegumi merged 1 commit from kiyi/comfy-build-network into main

2026-09-18 10:55:39 -05:00

kiyi commented

2026-09-18 01:39:11 -05:00

Member

Adds an explicit build_network: worker-pod opt-in, requiring the private loopback DinD endpoint and no Docker context override. Existing callers retain default. The selected mode is included in the signed receipt. The operator must verify a disposable engine per job; a loopback address alone is not proof of isolation. Owner dispatch, protected-branch authorization, scans and the separate signing/publishing job remain required.

Validation: seven container tests and seven credential-boundary regressions passed locally, including rejecting unsupported modes/endpoints, preserving default behavior, passing the selected Docker build argument, recording the mode in the receipt, and preventing publication after failed evidence. Workflow YAML/input wiring and git diff --check passed. Commit bd19963dae was fetched read-only and verified as kiyi author and committer, with exact tested contents. All hosted checks passed at bd19963dae: workflow acceptance run 240, repository security run 241, and library tests/integration run 242.

Adoption requires a new immutable minor workflow release and a reviewed caller update of both uses and library_ref; no existing release is changed. The full signed ComfyUI publication still requires acceptance. See adoption and rollback. Related to Comfy-UI issue #1 and application PR #3.

ComfyUI image builds exposed a nested Docker bridge DNS failure: the private worker pod could resolve the same source services, and using that pod network let application CI progress into dependency installation. The shared signed-image builder still used the failing default path. Adds an explicit `build_network: worker-pod` opt-in, requiring the private loopback DinD endpoint and no Docker context override. Existing callers retain `default`. The selected mode is included in the signed receipt. The operator must verify a disposable engine per job; a loopback address alone is not proof of isolation. Owner dispatch, protected-branch authorization, scans and the separate signing/publishing job remain required. Validation: seven container tests and seven credential-boundary regressions passed locally, including rejecting unsupported modes/endpoints, preserving default behavior, passing the selected Docker build argument, recording the mode in the receipt, and preventing publication after failed evidence. Workflow YAML/input wiring and `git diff --check` passed. Commit bd19963dae was fetched read-only and verified as kiyi author and committer, with exact tested contents. All hosted checks passed at bd19963dae: [workflow acceptance run 240](https://git.gitchegumi.com/Homelab/workflows/actions/runs/240/jobs/0), [repository security run 241](https://git.gitchegumi.com/Homelab/workflows/actions/runs/241/jobs/1), and [library tests/integration run 242](https://git.gitchegumi.com/Homelab/workflows/actions/runs/242/jobs/0). Adoption requires a new immutable minor workflow release and a reviewed caller update of both `uses` and `library_ref`; no existing release is changed. The full signed ComfyUI publication still requires acceptance. See [adoption and rollback](https://git.gitchegumi.com/Homelab/workflows/src/branch/kiyi/comfy-build-network/docs/container-build-network.md). Related to [Comfy-UI issue #1](https://git.gitchegumi.com/Homelab/Comfy-UI/issues/1) and [application PR #3](https://git.gitchegumi.com/Homelab/Comfy-UI/pulls/3).

kiyi added 1 commit

2026-09-18 01:39:11 -05:00

feat(container): add an explicit private worker build network

Workflow acceptance / acceptance (pull_request) Successful in 2m14s

Details

Repository security / security-1 (pull_request) Successful in 2m38s

Details

Repository security / security (pull_request) Successful in 0s

Details

Library checks / tests (pull_request) Successful in 3m3s

Details

bd19963dae