No route to host since macos-15-intel with `colima-network-address: true` set

[Ousret]

A recent change seems to break the colima-network-address: true usage.

The VM does start, the colima list says the VM have an IP, but we can't reach it from host. Constantly getting "No route to host".

Worked perfectly fine with:

• macos-12 (now deleted)
• macos-13 (pending deletion on December)
• macos-14-large (but costly... can't use it much)

stopped working with macos-15-intel.

I am completely clueless on why such silent failure would occurs and I have difficulties on getting my hand on a MacOS instance.

Tried to completely disable the firewall but no luck on that side.

regards,

[douglascamata]

@Ousret do you have a link to a failed build, so that I can have a look at the full logs and other useful information about the runner, please?

[douglascamata]

Also, which version of the action did you use?

[Ousret]

Of course. Latest version of the action (1.0.2) 5643cfd.

Here is the raw logs: https://productionresultssa1.blob.core.windows.net/actions-results/606c3705-2017-425b-b908-8d8c88f58a8e/workflow-job-run-9db689ac-48ce-5022-b009-f4379573dd9e/logs/job/job-logs.txt?rsct=text%2Fplain&se=2025-11-12T10%3A19%3A46Z&sig=tJmPdL%2BA3%2B0IDNTmaTh13JFtcVAJLdl82cPi1wVbEus%3D&ske=2025-11-12T20%3A23%3A57Z&skoid=ca7593d4-ee42-46cd-af88-8b886a2f84eb&sks=b&skt=2025-11-12T08%3A23%3A57Z&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skv=2025-11-05&sp=r&spr=https&sr=b&st=2025-11-12T10%3A09%3A41Z&sv=2025-11-05

Here is the GH formatted logs: https://github.com/jawah/urllib3.future/actions/runs/19259550102/job/55060978584

Regards,

[douglascamata]

Thanks, @Ousret. Later I will try to reproduce this with a more minimal setup (i.e. running Traefik on Docker and trying to reach it via the Colima network address) and see what's going on.

[douglascamata]

@Ousret I can reproduce and I'm trying to figure out if I can fix it. Meanwhile, with the intention of not leaving you blocked, does not using a network address and relying on localhost to access your Traefik does for you?

[Ousret]

Unfortunately the forwarding tunnel does not work for me. It's missing the UDP protocol and is very slow in addition to be flaky. GitHub does not plan to remove macos-13 before December minus a couple of brownout, so I guess I will remain attached to that meanwhile a proper solution is found.

Lima does mention being capable of forwarding UDP/TCP via GRPC (with somewhat decent performance?) instead of SSH but I was unsuccessful at making it happen.

Regards,

[douglascamata]

Not sure if I'll be able to fix this. I even could reproduce it in my macOS 15 machine: the VM's IP is reachable, then I enable my Tailscale network with an exit node and the VM's IP become unreachable and disabling Tailscale doesn't fix it... only a restart of the Colima VM fixes it.

I suspect it might be related to some upstream issues in Colima regarding VPN and something that Github is doing to the network setup of the macOS Action Runner VM, but I didn't find any solution there that worked. :(

[douglascamata]

I created abiosoft/colima#1448 to see if the Colima creator & the rest of the community can help.

[douglascamata]

@Ousret seems like this is unlikely to be fixed, given what I read at actions/runner-images#10924. It's related to Apple's design of LNP (local network policy) in macOS 15 and beyond. Github still didn't seem to have found a workaround even though they tried to work together with Apple on it.

[Ousret]

good finding! I suspected that Apple changed the permissions, even LLMs said that starting MacOS-15 there is a potential change that affect network.
Hopefully we would be able to leverage the root card to get out of that pit. Idk if the https://github.com/douglascamata/setup-docker-macos-action/tree/colima-network-address-issue branch is ready for prime time or not.

regards,