From 6c49dc282f94cdb3e46933e36f840534cf79020c Mon Sep 17 00:00:00 2001 From: Agents Agent Date: Fri, 26 Jun 2026 18:28:30 +0200 Subject: [PATCH] fix(agents-login): prefer IPv4 so codex login can reach auth.openai.com `codex login --device-auth` (codex 0.141.0) failed instantly with "error sending request for url (https://auth.openai.com/api/accounts/deviceauth/usercode)". The agents-login-worker pod has no working IPv6 egress (connect = ENETUNREACH), auth.openai.com publishes AAAA records, and codex's Rust HTTP client (glibc getaddrinfo on this Debian image) tries the IPv6 address first with no IPv4 fallback. Node-based clients (claude login) are unaffected because they happy-eyeball to IPv4. Add /etc/gai.conf with `precedence ::ffff:0:0/96 100` in the runtime stage so glibc getaddrinfo ranks IPv4-mapped addresses first and codex connects over IPv4 (which has working egress). Co-Authored-By: Claude Opus 4.8 (1M context) --- services/agents-login/Dockerfile | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/services/agents-login/Dockerfile b/services/agents-login/Dockerfile index 023c1019..86cae227 100644 --- a/services/agents-login/Dockerfile +++ b/services/agents-login/Dockerfile @@ -33,6 +33,12 @@ RUN npm install -g \ @openai/codex@${CODEX_VERSION} \ && npm cache clean --force +# Prefer IPv4: the cluster has no working IPv6 egress, but external hosts (e.g. +# auth.openai.com) publish AAAA records. glibc getaddrinfo (used by codex's Rust +# HTTP client) otherwise returns IPv6 first and codex fails with ENETUNREACH / +# "error sending request". Ranking IPv4-mapped addresses first makes codex use IPv4. +RUN printf 'precedence ::ffff:0:0/96 100\n' > /etc/gai.conf + ENV NODE_ENV=production \ HOME=/home/agent \ CODEX_HOME=/home/agent/.codex