Harden Docker release DNS

Author: Keith

.council/active-bughunt.md

@@ -29,6 +29,13 @@ jobs:
         run: ./scripts/ensure-release-tag-on-main.sh "${RELEASE_TAG}"
       - uses: docker/setup-qemu-action@v4
       - uses: docker/setup-buildx-action@v4
+        with:
+          buildkitd-config-inline: |
+            [dns]
+              nameservers = ["1.1.1.1", "9.9.9.9", "8.8.8.8"]
+
+            [registry."docker.io"]
+              mirrors = ["mirror.gcr.io"]
       - uses: docker/login-action@v4
         with:
           registry: ghcr.io

.council/latest-candidate-counts.md

@@ -13,6 +13,11 @@ All notable changes to IPTV Tunerr are documented here. Repo: [github.com/snapet
 
 ## [Unreleased]
 
+## [v0.1.83] - 2026-05-21
+
+### CI / Packaging
+- **Docker publishing no longer depends on the runner BuildKit container reaching Docker Hub DNS through one resolver:** BuildKit now gets explicit DNS servers and a Docker Hub mirror, covering the `registry-1.docker.io` lookup timeouts that survived a simple retry.
+
 ## [v0.1.82] - 2026-05-21
 
 ### Guide / XMLTV

.github/workflows/docker.yml

@@ -1,5 +1,6 @@
 **Current (2026-05-21):** Cut `v0.1.82` for short recurring XMLTV recording identity and release-channel hardening.
 
+- Update: `v0.1.82` Docker still failed after the one-shot retry; logs prove the BuildKit container cannot resolve `registry-1.docker.io` through `8.8.8.8` even though the host resolver works. Preparing follow-up `v0.1.83` with explicit BuildKit DNS plus a Docker Hub mirror.
 - Goal: commit the deployed `etalk`/short recurring show XMLTV identity fix plus fixes for failed `v0.1.81` package-channel publishing, push `main`, tag `v0.1.82`, and monitor release automation.
 - Scope: XMLTV recurring-title identity heuristic, Docker/COPR/PPA release workflow hardening, focused/full verification, changelog promotion, and release tag.
 - Assumption: `v0.1.81` covers the proxy DVR subscription-read hardening; this follow-up release is needed because tester logs showed the remaining failure was title-only guide identity for `etalk`.
@@ -9,7 +10,8 @@
 - Done: investigated failed `v0.1.81` package channels: Docker hit transient Docker Hub DNS resolution failures, COPR lacked `requests-gssapi` for configured GSSAPI auth, and the PPA workflow uploaded successfully from Actions but Launchpad later rejected the source upload because the `.dsc` was not readable in incoming processing.
 - Done: patched Docker publishing to retry the build/push once, COPR tooling to install `requests-gssapi`, and PPA upload to validate referenced files and upload payloads, `.dsc`, and `.changes` in an ordered retried sequence.
 - Verification: focused `go test -count=1 ./internal/tuner -run 'TestXMLTV_externalSourceRemap_Stabilizes(RecurringEventIdentity|ShortRecurringProgrammeIdentity)'` passed; full package `go test -count=1 ./internal/tuner` passed.
-- Next: rerun release-readiness after workflow patches, commit, push, tag `v0.1.82`, then monitor release workflows.
+- Verification: follow-up release-readiness after the Docker BuildKit DNS/mirror patch passed.
+- Next: commit/push the Docker follow-up, tag `v0.1.83`, then monitor Docker plus release-channel workflows.
 
 **Current (2026-05-21):** Cut `v0.1.81` for Plex DVR recording visibility hardening.
 

docs/CHANGELOG.md

@@ -299,6 +299,7 @@
 - Deployed the patched binary to the live tuner host, restarted Tunerr/proxy services, verified `etalk` guide rows now carry stable identity, reloaded both Plex DVR guides, and deleted the stale title-only subscription.
 - Investigated `v0.1.81` package-channel failures: Docker hit a transient Docker Hub DNS timeout, COPR lacked `requests-gssapi` for configured GSSAPI auth, and Launchpad rejected the PPA upload after Actions reported success because the `.dsc` was not readable during incoming processing.
 - Hardened release workflows: Docker build/push retries once, COPR installs `requests-gssapi`, and PPA upload validates the `.changes` file manifest then uploads payloads, `.dsc`, and `.changes` with retries in a safer order.
+- Follow-up: `v0.1.82` Docker still failed because the BuildKit container could not resolve `registry-1.docker.io` through `8.8.8.8`; patched BuildKit setup to use explicit DNS servers and the Docker Hub mirror before cutting `v0.1.83`.
 - Verification: focused XMLTV tests, `go test -count=1 ./internal/tuner`, YAML parsing for edited workflows, `git diff --check`, and `./scripts/release-readiness.sh` passed.
 
 ## 2026-05-20 - Release and deploy v0.1.80