fix(worker): stop 4 s DNS stalls on the isolated bridge by giving its containers their own resolvers

[GeiserX]

Every name lookup from a container on the isolated bridge stalled for about 4 seconds. Docker forwards those lookups from inside the container's network. When the host's Docker DNS list starts with a resolver the isolation rules block, such as Tailscale's 100.100.100.100, each lookup waits for Docker to fall through to the next server. On one fleet host that was thousands of stalls a day from five earners, plus a dockerd log line for each. Nothing failed outright.

Containers the worker puts on CASHPILOT_CONTAINER_NETWORK now get their own DNS servers. The new CASHPILOT_CONTAINER_DNS setting controls them and defaults to 1.1.1.1,9.9.9.9. Every other container, and the host itself, keeps Docker's list. Setting it empty brings back the old behaviour. A value that is not a list of IP addresses is refused before the running container is stopped.

Containers that already exist keep their old DNS until their next deploy. The worker does not recreate them by itself.

This change touches no catalog entry, guide or README table, so no referral link is affected.

Summary by CodeRabbit

• New Features
  • Containers on the configured network can use their own DNS server list, with configurable defaults or Docker’s resolver list. Changes take effect on the next deployment.
  • Invalid DNS server addresses are rejected before deployment affects a running container.
• Documentation
  • Updated configuration and network security guidance to explain container DNS behavior and setup.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: GeiserX/CashPilot/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: b343824b-68f8-45b7-bdfa-b3b8f2b67eae

📥 Commits

Reviewing files that changed from the base of the PR and between cf9f54b and b2ab0af.

📒 Files selected for processing (5)

• CLAUDE.md
• app/orchestrator.py
• docs/configuration.md
• docs/home-network-security.md
• tests/test_container_dns.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The worker now supports configurable DNS resolver addresses for containers on the configured bridge network. Deployment validates the addresses before replacing a running container and passes the resolved list to Docker. Tests and configuration guidance cover the setting and its behavior.

Changes

Container DNS configuration

Layer / File(s)	Summary
Resolve and apply container DNS app/orchestrator.py, tests/test_container_dns.py, CLAUDE.md, docs/configuration.md, docs/home-network-security.md	The worker parses and validates CASHPILOT_CONTAINER_DNS for containers on the configured bridge and passes the result to Docker during deployment. Tests cover configured, empty, absent, and invalid settings. The documentation describes the setting and its network scope.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to b2ab0

The DNS setting appears ready to merge after normal checks. Existing containers will receive it on their next deployment.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 12 functions across 2 files. (3 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the worker DNS change for the isolated bridge and its purpose of preventing DNS stalls.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 12 functions across 2 files. (3 skipped: 3 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.84%. Comparing base (cf9f54b) to head (b2ab0af).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #421   +/-   ##
=======================================
  Coverage   95.84%   95.84%           
=======================================
  Files          52       52           
  Lines        7598     7611   +13     
=======================================
+ Hits         7282     7295   +13     
  Misses        316      316           

Files with missing lines	Coverage Δ
app/orchestrator.py	91.04% <100.00%> (+0.19%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.