bind-interfaces binds the device once, at startup, and does not survive that
device being recreated. A Docker bridge is recreated whenever its network is -
which re-running the installer does - so dnsmasq ends up holding a socket on
an interface that no longer exists. It is bound according to ss, it is
"active (running)" according to systemctl, and it answers nothing. Every job
then fails at apt with "Temporary failure resolving", which points at the
package manager, the network, or the allowlist, and never at this.
bind-dynamic keeps the same property that mattered - the resolver stays off
every other address on this host, rather than contending for :53 with whatever
else is listening - and picks the interface back up when it reappears.
install.sh also restarts dnsmasq after the network step rather than only after
writing the config, since that is the moment the bridge may have just been
created.
And dejima-ci-firewall now probes the resolver and says so when it does not
answer, including the specific shape of it: bound in ss but silent means the
interface went away underneath it. That script already runs on every Docker
start, which is exactly when a bridge may have been recreated, so it is the
right place to notice - and a warning naming the cause is worth more here than
one more thing that only shows up as apt failing to resolve.
branderson
9032362b54