From 6fd9372e572212145a9287f941054f02f8cc7334 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 24 Apr 2026 20:18:14 +0000
Subject: [PATCH 1/2] Initial plan


From c819438ffdafe86bfa0098b3efcf1e1c9429c00b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 24 Apr 2026 20:21:57 +0000
Subject: [PATCH 2/2] fix: strip IPv6 http_port listeners when IPv6 is disabled
 in Squid container

---
 containers/squid/entrypoint.sh | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/containers/squid/entrypoint.sh b/containers/squid/entrypoint.sh
index 24f3e4ba0..6c5d385bd 100644
--- a/containers/squid/entrypoint.sh
+++ b/containers/squid/entrypoint.sh
@@ -9,5 +9,18 @@ if [ -d "/var/spool/squid_ssl_db" ]; then
   echo "[squid-entrypoint] SSL Bump mode detected - SSL database ready"
 fi
 
+# Check if IPv6 is available in this container namespace.
+# On Docker daemons with `ipv6: false` (the default on most Linux distros), the kernel
+# sets net.ipv6.conf.all.disable_ipv6=1 inside every container network namespace.
+# Squid treats `http_port [::]:3128` as a FATAL error when IPv6 is unavailable, aborting
+# before opening log files and causing the container to exit(1) immediately.
+# If IPv6 is disabled we strip the dual-stack listener lines so Squid can start normally.
+# The defense-in-depth intent is preserved on runners that do have IPv6 enabled.
+IPV6_DISABLED="$(cat /proc/sys/net/ipv6/conf/all/disable_ipv6 2>/dev/null || echo 1)"
+if [ "$IPV6_DISABLED" = "1" ]; then
+  echo "[squid-entrypoint] IPv6 is disabled in this namespace - removing http_port [::]: listeners to prevent fatal startup error"
+  sed -i '/^http_port \[::\]:/d' /etc/squid/squid.conf
+fi
+
 # Start Squid directly (already running as proxy user via Dockerfile USER directive)
 exec squid -N -d 1