From 7c97a428ae073d3e85e88003052aaf91e015041d Mon Sep 17 00:00:00 2001
From: Ondrej Belusky <zlymeda@gmail.com>
Date: Tue, 1 Sep 2026 13:25:02 +0200
Subject: [PATCH] fix: publish buildkitd port to host loopback, endpoint
 tcp://127.0.0.1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Second failure mode: act_runner executes job steps in executor
containers running with network=host (despite container.network
config — that only applies to job containers). The buildx CLI
therefore resolves tcp://buildkitd:8375 in the HOST namespace,
where docker DNS names do not resolve.

Fix: publish buildkitd's TCP port to host loopback
(-p 127.0.0.1:8375:8375) and use tcp://127.0.0.1:8375 as the
endpoint. Works from both host-network executors and job
containers; port is not exposed on any external interface.

Validated on oracle: buildx remote Status running,
platforms linux/arm64,v7,v6.
---
 action.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/action.yml b/action.yml
index 6f3bb93..7edd326 100644
--- a/action.yml
+++ b/action.yml
@@ -39,6 +39,7 @@ runs:
         docker ps -a --format '{{.Names}}' | grep -qx '${{ inputs.container_name }}' || \
         docker run -d --name ${{ inputs.container_name }} --privileged \
           --network ${{ inputs.network }} \
+          -p 127.0.0.1:${{ inputs.port }}:${{ inputs.port }} \
           --restart unless-stopped \
           --label com.centurylinklabs.watchtower.monitor-only=${{ inputs.monitor_only }} \
           --label dockhand.notify=${{ inputs.dockhand_notify }} \
@@ -48,7 +49,7 @@ runs:
       uses: docker/setup-buildx-action@v4
       with:
         driver: remote
-        endpoint: tcp://${{ inputs.container_name }}:${{ inputs.port }}
+        endpoint: tcp://127.0.0.1:${{ inputs.port }}
 
     - name: Stop BuildKit (idle cleanup)
       if: ${{ inputs.cleanup == 'true' && always() }}