From dfa5667548d2f41cc88759d0257ab288911d59a7 Mon Sep 17 00:00:00 2001
From: Stefan Saenger <stefan.saenger@vnc.biz>
Date: Thu, 6 Aug 2026 11:25:33 +0200
Subject: [PATCH] fix(ci): point DinD at the docker service alias, not
 localhost

The build job failed with:
  Cannot connect to the Docker daemon at tcp://localhost:2375.
  Is the docker daemon running?

Three things were wrong:

1. DOCKER_HOST was set to tcp://localhost:2375. The DinD daemon runs in
   the service sidecar container, not in the build container, so
   localhost was always going to refuse the connection. The correct host
   is the service alias 'docker'.

2. The docker:28.4.0-dind service was declared without an explicit
   alias. Without alias: docker, GitLab derives the hostname from the
   image string 'docker:28.4.0-dind', and since ':' is invalid in DNS,
   the 'docker' hostname never resolves. The explicit alias is required
   for tcp://docker:2375 to work at all.

3. docker:28.4.0-dind enables TLS by default and listens on 2376, but
   DOCKER_HOST points at 2375. Setting DOCKER_TLS_CERTDIR="" disables
   TLS so the daemon listens on plaintext 2375, matching DOCKER_HOST.

This mirrors the known-working pattern in the vnc-localidp pipeline
(docker:20.10.17-dind + alias: docker + DOCKER_HOST=tcp://docker:2375
+ DOCKER_TLS_CERTDIR=""). The TLS-defaults behavior has been unchanged
since docker 19.03, so the same pattern applies on 28.4.0.
---
 .gitlab-ci.yml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index e2a71612..1818d462 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -40,7 +40,11 @@ variables:
   IMAGE: $CI_REGISTRY_IMAGE
   GIT_STRATEGY: clone
   DOCKER_DRIVER: overlay2
-  DOCKER_HOST: tcp://localhost:2375    
+  # DinD service is reached at the `docker` alias (set explicitly on the
+  # service below), not localhost. TLS disabled so the daemon listens on
+  # plaintext 2375 — same pattern as the working vnc-localidp pipeline.
+  DOCKER_HOST: tcp://docker:2375
+  DOCKER_TLS_CERTDIR: ""
 
 # ---------------------------------------------------------------------------
 # verify — required check on every MR into dev. No registry, no cluster.
@@ -69,7 +73,8 @@ build:
   stage: build
   image: docker:28.4.0
   services:
-    - docker:28.4.0-dind
+    - name: docker:28.4.0-dind
+      alias: docker
   rules:
     - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "dev"'
   before_script: