feat: custom forgejo-runner-node image with docker.io pre-installed

- Dockerfile.node extends node:22-bookworm + docker.io
- CI workflow builds and pushes to forgejo registry on changes
- values-node.yaml references custom image instead of stock node
- Removes need to install docker in every workflow using node runner

.gitea/workflows/build-runner-node.yml

@@ -0,0 +1,45 @@
+name: Build forgejo-runner-node image
+
+on:
+  push:
+    paths:
+      - 'k8s/infra/forgejo-runner/Dockerfile.node'
+    branches:
+      - main
+
+jobs:
+  build:
+    runs-on: golang
+    env:
+      REGISTRY: forgejo.riotpiao.com
+      IMAGE: forgejo.riotpiao.com/rock/forgejo-runner-node
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Get short SHA
+        id: sha
+        run: |
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
+
+      - name: Registry login
+        run: |
+          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
+            --username "${REGISTRY_USER}" --password-stdin
+        env:
+          REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
+
+      - name: Build image
+        run: |
+          docker build -f k8s/infra/forgejo-runner/Dockerfile.node \
+            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
+            -t "${IMAGE}:latest" \
+            .
+
+      - name: Push image
+        run: |
+          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+          docker push "${IMAGE}:latest"
+          echo "✓ Image pushed: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"

k8s/infra/forgejo-runner/Dockerfile.node

@@ -0,0 +1,13 @@
+FROM node:22-bookworm
+
+# Install Docker client (dind sidecar provides the daemon)
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+      docker.io \
+      git \
+      curl \
+      ca-certificates && \
+    rm -rf /var/lib/apt/lists/*
+
+# Verify installation
+RUN docker --version && node --version

k8s/infra/forgejo-runner/values-node.yaml

@@ -2,11 +2,12 @@
 # runner instance. Only runner.name and runner.labels differ -- everything
 # else (image, dind, persistence, tolerations, nodeSelector) is shared.
 #
-# node:22-bookworm ships Node natively, so unlike the golang/rust instances,
-# jobs on this runner need no "install node" step before actions/checkout.
+# forgejo-runner-node extends node:22-bookworm with docker.io, so Node + Docker
+# are both available. Built and pushed via homelab CI (build-runner-node.yml).
 runner:
   name: node-runner
-  labels: "node:docker://node:22-bookworm"
+  # Custom image extends node:22-bookworm with docker.io pre-installed
+  labels: "node:docker://forgejo.riotpiao.com/rock/forgejo-runner-node:latest"
 
 # GC CronJob renders only from the default (golang) values to avoid duplicates
 gc: