From 594e752d47a696e762bc147ba140985b10ca7175 Mon Sep 17 00:00:00 2001 From: rock Date: Mon, 7 Sep 2026 13:16:49 -0700 Subject: [PATCH] fix: runner uses unix socket instead of TLS TCP for dind Job containers spawned by the runner run inside dind. With TCP+TLS (tcp://localhost:2376), localhost inside those containers doesn't reach the dind sidecar. Unix socket at /run/docker.sock works because both runner and dind share the /run emptyDir. Also disables DOCKER_TLS_CERTDIR so dind creates the socket instead of only listening on TLS TCP. --- k8s/infra/forgejo-runner/templates/deployment.yaml | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/k8s/infra/forgejo-runner/templates/deployment.yaml b/k8s/infra/forgejo-runner/templates/deployment.yaml index 2ef614f..5d8c44c 100644 --- a/k8s/infra/forgejo-runner/templates/deployment.yaml +++ b/k8s/infra/forgejo-runner/templates/deployment.yaml @@ -64,11 +64,7 @@ spec: workingDir: /data env: - name: DOCKER_HOST - value: tcp://localhost:2376 - - name: DOCKER_TLS_VERIFY - value: "1" - - name: DOCKER_CERT_PATH - value: /docker-certs/client + value: unix:///run/docker.sock volumeMounts: - name: runner-data mountPath: /data @@ -91,7 +87,7 @@ spec: privileged: true # required for DinD; cicd namespace is labelled privileged env: - name: DOCKER_TLS_CERTDIR - value: /docker-certs + value: "" volumeMounts: - name: docker-certs mountPath: /docker-certs