fix(headless): resolve host.docker.internal for Harbor's in-container arms - #2062
Merged
Merged
Conversation
… arms Codex and Claude Code reach the host credential proxy by dialling host.docker.internal. Docker Desktop injects that name; native Linux Docker does not, and Harbor's linux/amd64 compose override declared only `platform`. On a bare-metal Linux benchmark VM every competitor cell therefore died before its first model step -- Codex as a connect error after five reconnects, Claude Code as ENOTFOUND after ten retries and 170 seconds -- while the Maka arm passed, because a Maka host cell talks to the proxy over loopback and never needs the name. That shape is the danger: the harness looked like it was measuring two broken competitors rather than one missing container DNS entry. pier-task-runner.ts already documents this exact Linux gap and threads providerProxyAdvertisedHost to escape it, but MAKA_HARNESS_AB_PROVIDER_ PROXY_ADVERTISED_HOST covers only the Pier path. Fix it where the platform difference already lives instead: the compose override is applied precisely when dockerPlatform is linux/amd64, so mapping the name to host-gateway there keeps the advertised host identical on both platforms and leaves the manifest, prompts, and fingerprints untouched. Refs #1970.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The first real three-arm canary on a bare-metal Linux VM produced a result that reads like a competitor indictment: Maka 3 passed / 2 budget-exhausted, Codex 5/5
infra_failed, Claude Code 5/5plumbing_failed. Both competitor arms had in fact died before their first model step, for one reason.In-container agents dial
host.docker.internalto reach the host credential proxy (provider-auth-proxy.tsdefaultsadvertisedHostto that name). Docker Desktop injects it; native Linux Docker does not, and Harbor's linux/amd64 compose override declared onlyplatform. So the name did not resolve:stream disconnected before completion: error sending request for url (http://host.docker.internal:34151/responses), five reconnects thenturn.failedAPI Error: Unable to connect to API (ENOTFOUND), ten retries over 170sThe Maka arm passed throughout, because a Maka host cell reaches the proxy on loopback and never needs the name. That is what makes this worth pinning rather than just patching: a missing container DNS entry presented as the two competitors are broken, on exactly the axis the benchmark exists to measure.
pier-task-runner.ts:180-186already documents this Linux gap and threadsproviderProxyAdvertisedHostpast it, butMAKA_HARNESS_AB_PROVIDER_PROXY_ADVERTISED_HOSTreaches only the Pier path; the Harbor path has no equivalent knob. Rather than add one, fix it where the platform difference already lives.harbor-task-runner.tsattaches the compose override precisely whendockerPlatform === 'linux/amd64', so mapping the name tohost-gatewaythere fixes native Linux, is a no-op on Docker Desktop, and keeps the advertised host byte-identical across platforms — manifests, prompt hashes, and fingerprints are untouched, so a Linux run stays comparable with a macOS one.Refs #1970.
Verification
getent hosts host.docker.internalreturns nothing172.17.0.1 host.docker.internalnpm run test -w @maka/headless— 1338 pass / 0 fail / 1 skip, including the added contract test.npm run lint,npm run format:check,git diff --check— clean.Review focus
The added test asserts the compose file's content rather than a runner behavior. That is deliberate: no unit-level assertion over
buildHarborJobConfigcan observe container DNS, and the failure mode this guards against is the two lines silently going away. The cost of that regression is a wasted multi-hour, real-spend benchmark run whose output looks like data.