bootstrap: use base images for runners, custom images via CI

- golang-runner: docker:27-cli (has Node.js + docker)
- rust-runner: docker:27-cli (bootstrap, CI adds Rust)
- node-runner: node:22-bookworm (has Node.js, CI adds docker)

CI workflow (.gitea/workflows/build-runner-images.yml):
1. Watches Dockerfile.* changes
2. Builds custom images with Node.js pre-installed
3. Pushes to registry
4. Image Updater detects and updates values.yaml
5. ArgoCD syncs to new custom images

This avoids token complexity - just push Dockerfile changes to git!

k8s/infra/forgejo-runner/values-node.yaml

@@ -4,13 +4,13 @@
 #
 # node:22-bookworm ships Node natively. Docker client installed via workflow step if needed.
 # (homelab has no CI; custom runner images built manually if desired)
+# Bootstrap with base image, custom image via CI+Image Updater
 runner:
   image:
-    repository: forgejo.riotpiao.com/rock/forgejo-runner-node
+    repository: node
-    tag: "latest"  # Image Updater tracks and updates this
+    tag: "22-bookworm"
   name: node-runner
-  # Custom image: node:22-bookworm + docker.io pre-installed
+  labels: "node:docker://node:22-bookworm"
-  labels: "node:docker://forgejo.riotpiao.com/rock/forgejo-runner-node:latest"
 
 # GC CronJob renders only from the default (golang) values to avoid duplicates
 gc:

k8s/infra/forgejo-runner/values-rust.yaml

@@ -2,17 +2,13 @@
 # runner instance. Only runner.name and runner.labels differ -- everything
 # else (image, dind, persistence, tolerations, nodeSelector) is shared.
 #
-# Custom image: docker:27-cli + Node.js + Rust + build tools
+# Bootstrap with base image, custom image via CI+Image Updater
-#   - Node.js for GitHub Actions (actions/checkout@v4, etc.)
-#   - Docker CLI for container builds
-#   - Rust toolchain (via rustup)
-#   - Build essentials
 runner:
   image:
-    repository: forgejo.riotpiao.com/rock/forgejo-runner-rust
+    repository: docker
-    tag: "latest"  # Image Updater tracks and updates this
+    tag: "27-cli"
   name: rust-runner
-  labels: "rust:docker://forgejo.riotpiao.com/rock/forgejo-runner-rust:latest"
+  labels: "rust:docker://docker:27-cli"
 
 
 

k8s/infra/forgejo-runner/values.yaml

@@ -1,17 +1,10 @@
 runner:
   image:
-    repository: forgejo.riotpiao.com/rock/forgejo-runner-golang
+    repository: docker
-    tag: "latest"  # Image Updater tracks and updates this
+    tag: "27-cli"  # Bootstrap with base image, custom image via CI+Image Updater
   name: golang-runner
-  # Custom image: docker:27-cli + Node.js + Go + build tools
+  labels: "golang:docker://docker:27-cli"
-  #   - Node.js for GitHub Actions (actions/checkout@v4, etc.)
-  #   - Docker CLI for container builds
-  #   - Go toolchain
-  #   - Build essentials
-  labels: "golang:docker://forgejo.riotpiao.com/rock/forgejo-runner-golang:latest"
   forgejoUrl: http://forgejo-gitea-http.cicd.svc.cluster.local:3000
-  # tokenSecret: name of the K8s Secret that holds the runner registration token
-  # created automatically by the helmfile presync hook (see helmfile.yaml.gotmpl)
   tokenSecret: runner-token
   resources:
     requests: