@norskvideo/ctl-dev-kit 0.2.17 → 0.2.18

package/conventions/integration.yml

@@ -178,6 +178,39 @@ jobs:
             echo "NORSK_RUNNER_OWNS_DOCKER=true" >> "$GITHUB_ENV"
           fi
 
+      # Integration needs this host's docker to be able to create a network: the
+      # harness makes norsk-net and a network per instance. On 2026-10-02
+      # ashton-nuc's filter table had lost DOCKER-ISOLATION-STAGE-2, so every
+      # create failed with "Chain 'DOCKER-ISOLATION-STAGE-2' does not exist" --
+      # and commentary, probe and playout each ran a FULL integration suite on it
+      # and reported the result as test failures, 18 and 72 chain errors deep in
+      # their logs. The same host took four of that night's norsk image jobs down
+      # the same way. Nothing said "this machine's docker is broken".
+      #
+      # The chain is not readable without root on these runners, so this asserts
+      # the capability instead: create a throwaway network, remove it. One step,
+      # its own name, so the jobs API attributes the failure to it rather than to
+      # whatever composite step happened to be running.
+      - name: Check this host's docker can still create a network
+        run: |
+          set -uo pipefail
+          net="preflight-${{ github.run_id }}-${{ github.run_attempt }}-$RANDOM"
+          if err=$(docker network create "$net" 2>&1); then
+            docker network rm "$net" >/dev/null 2>&1 || true
+            echo "docker can create networks on $(hostname) -- ok"
+            exit 0
+          fi
+          echo "::error::docker on this runner cannot create a network, so every container this suite starts would silently not exist -- the tests would fail for a reason that is not theirs. Host: $(hostname). Fix: \`sudo systemctl restart docker\` on that machine (it rebuilds the DOCKER/DOCKER-ISOLATION iptables chains), then re-run."
+          echo "$err"
+          echo "--- docker0 (a subnet other than 172.17.0.1/16 means it was re-addressed) ---"
+          ip -br addr show docker0 2>/dev/null || true
+          echo "--- networks and their subnets ---"
+          for n in $(docker network ls --format '{{.Name}}' 2>/dev/null); do
+            printf '%-28s ' "$n"
+            docker network inspect "$n" --format '{{range .IPAM.Config}}{{.Subnet}} {{end}}' 2>/dev/null || echo
+          done
+          exit 1
+
       # `product add --image` publishes the control plane on 127.0.0.1:14321. The
       # daemon means to reap it on shutdown (daemon.ts, model B) but only does so
       # gracefully, and this workflow cancels its own superseded runs -- a killed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.2.17",
+  "version": "0.2.18",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",