fix: add CoreDNS api.riotpiao.com rewrite + fix runner Alpine base image (#1)

1. Forgejo CI is broken across all repos Every workflow fails because runner labels point to a bare Alpine image with nothing in it. ┌────────────────────────────────────────┬──────────────────────────────────────┐ │ Before │ After │ ├────────────────────────────────────────┼──────────────────────────────────────┤ │ golang:docker://forgejo/runner:6 │ golang:docker://golang:1.26-bookworm │ ├────────────────────────────────────────┼──────────────────────────────────────┤ │ No Go, no Node.js, no apt-get, no root │ Go, git, apt-get, root │ └────────────────────────────────────────┴──────────────────────────────────────┘ Plus the docker socket isn't shared between dind sidecar and runner, so even if docker CLI existed, it can't reach the daemon. ┌───────────────────────────────────────────┬─────────────────────────────────────────────────────────────┐ │ Before │ After │ ├───────────────────────────────────────────┼─────────────────────────────────────────────────────────────┤ │ dind creates socket in its own filesystem │ Shared /run emptyDir volume │ ├───────────────────────────────────────────┼─────────────────────────────────────────────────────────────┤ │ Runner can't see it │ Both containers see /run/docker.sock │ ├───────────────────────────────────────────┼─────────────────────────────────────────────────────────────┤ │ No docker_host config │ docker_host: automount passes socket to workflow containers │ Co-authored-by: rock <[email protected]>
2026-09-07 05:19:39 +00:00
parent 6b7e556d81
commit 913cfc2f40
10 changed files with 19 additions and 114 deletions
@@ -1,12 +0,0 @@
-FROM code.forgejo.org/forgejo/runner:6
-
-# Install Node.js + Docker client (needed for GitHub Actions + docker build)
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-      nodejs \
-      npm \
-      docker.io && \
-    rm -rf /var/lib/apt/lists/*
-
-# Verify installations
-RUN docker --version && node --version && git --version
@@ -1,11 +0,0 @@
-FROM code.forgejo.org/forgejo/runner:6
-
-# Install Docker client (forgejo/runner base doesn't include it)
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-      docker.io && \
-    rm -rf /var/lib/apt/lists/*
-
-# Verify installations
-RUN node --version && docker --version && git --version
-# Trigger node-runner build with docker
@@ -1,16 +0,0 @@
-FROM code.forgejo.org/forgejo/runner:6
-
-# Install Node.js + Rust (needed for GitHub Actions checkout@v4, etc.)
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-      nodejs \
-      npm && \
-    rm -rf /var/lib/apt/lists/*
-
-# Install Rust
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
-
-ENV PATH="/root/.cargo/bin:${PATH}"
-
-# Verify installations
-RUN docker --version && node --version && git --version && rustc --version
@@ -36,3 +36,4 @@ data:
      valid_volumes:
        - /docker-certs/client
      network: host
+      docker_host: automount
@@ -70,6 +70,8 @@ spec:
              mountPath: /data
            - name: docker-certs
              mountPath: /docker-certs
+            - name: docker-sock
+              mountPath: /run
            - name: homelab-ca
              mountPath: /etc/ssl/certs/homelab-ca.pem
              subPath: ca.crt
@@ -89,6 +91,8 @@ spec:
          volumeMounts:
            - name: docker-certs
              mountPath: /docker-certs
+            - name: docker-sock
+              mountPath: /run
            - name: dind-storage
              mountPath: /var/lib/docker
            - name: homelab-ca
@@ -113,6 +117,8 @@ spec:
            claimName: {{ .Release.Name }}-dind
        - name: docker-certs
          emptyDir: {}    # DinD regenerates mTLS certs on each start
+        - name: docker-sock
+          emptyDir: {}    # Shared docker socket between dind and runner
        - name: homelab-ca
          # homelab-ca is a ConfigMap (public CA trust bundle), not a Secret.
          # The volumeMounts use subPath: ca.crt to project the single cert file.
@@ -2,15 +2,14 @@
 # runner instance. Only runner.name and runner.labels differ -- everything
 # else (image, dind, persistence, tolerations, nodeSelector) is shared.
 #
-# node:22-bookworm ships Node natively. Docker client installed via workflow step if needed.
-# (homelab has no CI; custom runner images built manually if desired)
-# Bootstrap with runner image (already has Node.js), CI builds custom
+# Label image: node:22-bookworm — Debian, root, apt-get, Node.js, npm, git.
+# Install docker in workflow steps as needed.
 runner:
  image:
    repository: code.forgejo.org/forgejo/runner
    tag: "6"
  name: node-runner
-  labels: "node:docker://code.forgejo.org/forgejo/runner:6"
+  labels: "node:docker://node:22-bookworm"

 # GC CronJob renders only from the default (golang) values to avoid duplicates
 gc:
@@ -2,13 +2,14 @@
 # runner instance. Only runner.name and runner.labels differ -- everything
 # else (image, dind, persistence, tolerations, nodeSelector) is shared.
 #
-# Bootstrap with runner image, CI builds custom with Node.js+Rust
+# Label image: rust:1-bookworm — Debian, root, apt-get, Rust, cargo, git.
+# Install Node.js/docker in workflow steps as needed.
 runner:
  image:
    repository: code.forgejo.org/forgejo/runner
    tag: "6"
  name: rust-runner
-  labels: "rust:docker://code.forgejo.org/forgejo/runner:6"
+  labels: "rust:docker://rust:1-bookworm"



@@ -1,9 +1,12 @@
 runner:
  image:
    repository: code.forgejo.org/forgejo/runner
-    tag: "6"  # Bootstrap with runner image, CI builds custom with Node.js
+    tag: "6"
  name: golang-runner
-  labels: "golang:docker://code.forgejo.org/forgejo/runner:6"
+  # Label image is what workflow steps run in (NOT the runner daemon image).
+  # golang:1.26-bookworm: Debian, root, apt-get, Go, git.
+  # Install Node.js/docker in workflow steps as needed.
+  labels: "golang:docker://golang:1.26-bookworm"
  forgejoUrl: http://forgejo-gitea-http.cicd.svc.cluster.local:3000
  tokenSecret: runner-token
  resources: