From c82077e6b5852602f298fc8ca2bfde22f787c1ca Mon Sep 17 00:00:00 2001 From: stecklars Date: Mon, 16 Feb 2026 07:56:45 +0000 Subject: [PATCH] examples: improve DIND rootless network performance (#786) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - Add `DOCKERD_ROOTLESS_ROOTLESSKIT_NET=slirp4netns` and `DOCKERD_ROOTLESS_ROOTLESSKIT_MTU=65520` to the DIND docker-compose example - The `docker:dind-rootless` base image defaults to vpnkit as the network driver, which has substantially lower throughput than slirp4netns ## The problem I noticed that pulling containers as well as downloading data within the container when running act_runner as DIND was very slow (see Ookla speedtest results in the following). While analysing the issue, I found that this was caused by the usage of vpnkit. The `docker:dind-rootless` base image defaults to vpnkit as the network driver. slirp4netns was [added as an opt-in option](https://github.com/docker-library/docker/pull/543) and must be explicitly enabled via `DOCKERD_ROOTLESS_ROOTLESSKIT_NET=slirp4netns`. This means anyone following the current DIND example gets vpnkit, which has significantly lower network throughput. This affects **all** network operations in the container — image pulls, package installs, and CI tasks. Per the [rootlesskit iperf3 benchmarks](https://github.com/rootless-containers/rootlesskit/blob/master/docs/network.md): | Driver | MTU 1500 | MTU 65520 | |--------|----------|-----------| | **vpnkit** | 0.60 Gbps | not supported | | **slirp4netns** | 1.06 Gbps | 7.55 Gbps | ## Real-world benchmark results (Ookla speedtest, same server) | | Download | Upload | |---|---|---| | **Default (vpnkit)** | ~130 Mbps | ~126 Mbps | | **slirp4netns + MTU 65520** | ~958 Mbps | ~462 Mbps | ## References - [docker-library/docker#543](https://github.com/docker-library/docker/pull/543) — added slirp4netns to dind-rootless as opt-in (vpnkit remains default) - [rootlesskit network docs](https://github.com/rootless-containers/rootlesskit/blob/master/docs/network.md) — iperf3 benchmarks --------- Co-authored-by: Lunny Xiao Reviewed-on: https://gitea.com/gitea/act_runner/pulls/786 Reviewed-by: silverwind Co-authored-by: stecklars Co-committed-by: stecklars --- examples/docker-compose/README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/examples/docker-compose/README.md b/examples/docker-compose/README.md index f372d3b..76ffd0f 100644 --- a/examples/docker-compose/README.md +++ b/examples/docker-compose/README.md @@ -53,6 +53,9 @@ environment: - GITEA_INSTANCE_URL= - DOCKER_HOST=unix:///var/run/user/1000/docker.sock + # Use slirp4netns instead of vpnkit for significantly better network throughput. + - DOCKERD_ROOTLESS_ROOTLESSKIT_NET=slirp4netns + - DOCKERD_ROOTLESS_ROOTLESSKIT_MTU=65520 # When using Docker Secrets, it's also possible to use # GITEA_RUNNER_REGISTRATION_TOKEN_FILE to pass the location. # The env var takes precedence.