From a3a647318d6ac5509a3d7a2694de1bc2fa6e57b1 Mon Sep 17 00:00:00 2001
From: Hyperling <me@hyperling.com>
Date: Mon, 2 Nov 2026 20:51:16 -0700
Subject: [PATCH] docker, ensure container networks accurately reflect host
 network when using network_mode:host on runit systems.

---
 tasks/workstation/linux/software/docker.yml | 97 +++++++++++++++++----
 1 file changed, 80 insertions(+), 17 deletions(-)

diff --git a/tasks/workstation/linux/software/docker.yml b/tasks/workstation/linux/software/docker.yml
index 9201119..19153cf 100644
--- a/tasks/workstation/linux/software/docker.yml
+++ b/tasks/workstation/linux/software/docker.yml
@@ -33,21 +33,84 @@
     owner: root
     mode: '0755'
 
-#- name: Workstation | Linux | Software | Docker | Config | File
-#  ansible.builtin.copy:
-#    dest: /etc/docker/daemon.json
-#    content: |
-#      {
-#        "dns": ["194.242.2.2", "1.0.0.1", "1.1.1.1"]
-#      }
-#    backup: false
-#    owner: root
-#    mode: '0644'
-#  when: ansible_pkg_mgr == "pacman"
+- name: Workstation | Linux | Software | Socker | Services | Enable
+  ansible.builtin.service:
+    name: "{{ item.name }}"
+    state: "{{ 'started' if item.status else 'stopped' }}"
+    enabled: "{{ item.status }}"
+  loop:
+    - { 'name': 'docker'                   , 'status': true }
 
-#- name: Workstation | Linux | Software | Docker | Config | File
-#  ansible.builtin.file:
-#    name: /etc/docker/daemon.json
-#    state: absent
-#    owner: root
-#    mode: '0755'
+- name: Workstation | Linux | Software | Docker | Network Sync | runit | Facts
+  ansible.builtin.set_fact:
+    docker_network_sync: "docker-network-sync"
+
+- name: Workstation | Linux | Software | Docker | Network Sync | runit | Block
+  block:
+
+    - name: Workstation | Linux | Software | Docker | Network Sync | runit | /etc/sv
+      ansible.builtin.file:
+        name: "/etc/sv/{{ docker_network_sync }}/log"
+        state: directory
+        owner: root
+        mode: "0755"
+
+    - name: Workstation | Linux | Software | Docker | Network Sync | runit | /var/log
+      ansible.builtin.file:
+        name: "/var/log/{{ docker_network_sync }}"
+        state: directory
+        owner: "{{ user }}"
+        mode: "0755"
+
+    - name: Workstation | Linux | Software | Docker | Network Sync | runit | Run
+      ansible.builtin.copy:
+        dest: /etc/sv/{{ docker_network_sync }}/run
+        content: |
+          #!/bin/sh
+          # Ensure all containers using host network keep a correct resolv.conf.
+          exec 2>&1
+          set -e
+
+          while true; do
+            for c in $(docker container ls --filter network=host -q); do
+              echo "RUN: Container ID $c"
+              docker exec -i -u root $c sh -c 'tee /etc/resolv.conf' < /etc/resolv.conf
+            done
+            echo "RUN: Done, sleeping."
+            sleep 20
+          done
+        backup: false
+        owner: root
+        mode: '0644'
+
+    - name: Workstation | Linux | Software | Docker | Network Sync | runit | Finish
+      ansible.builtin.copy:
+        dest: /etc/sv/{{ docker_network_sync }}/finish
+        content: |
+          {{ runit_finish_sleep }}
+        mode: "0755"
+
+    - name: Workstation | Linux | Software | Docker | Network Sync | runit | Log
+      ansible.builtin.copy:
+        dest: /etc/sv/{{ docker_network_sync }}/log/run
+        content: |
+          #!/bin/sh -e
+          exec svlogd -tt /var/log/{{ docker_network_sync }}
+        mode: "0755"
+
+    - name: Workstation | Linux | Software | Docker | Network Sync | runit | Log Config
+      ansible.builtin.copy:
+        dest: /var/log/{{ docker_network_sync }}/config
+        content: |
+          {{ runit_log_config_1mb }}
+        mode: "0755"
+
+    - name: Workstation | Linux | Software | Socker | Services | Enable
+      ansible.builtin.service:
+        name: "{{ item.name }}"
+        state: "{{ 'started' if item.status else 'stopped' }}"
+        enabled: "{{ item.status }}"
+      loop:
+        - { 'name': '{{ docker_network_sync }}', 'status': true }
+
+  when: ansible_service_mgr == "runit"