From ce154c55e640c8a0939f3bf6dd5af86d64fe0a19 Mon Sep 17 00:00:00 2001
From: rock <locartrock@gmail.com>
Date: Sun, 6 Sep 2026 07:15:01 -0700
Subject: [PATCH] fix: share docker socket between dind and runner via emptyDir
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ROOT CAUSE: Docker socket (/var/run/docker.sock) only existed inside the
dind container — the runner container couldn't see it. The runner connected
to dind via TCP (tcp://localhost:2376) with TLS. But workflow containers
created by the runner had NO way to access the docker daemon:
- unix socket not mounted (runner can't see it)
- DOCKER_HOST env var not passed (runner.envs not configured)

FIX: Share /var/run between dind and runner via emptyDir volume.
When dind starts, it creates /var/run/docker.sock in the shared volume.
Runner can now see the socket. docker_host: automount in config tells
the runner to mount the socket into job containers automatically.

Architecture after fix:
  dind container → creates /var/run/docker.sock → shared emptyDir
  runner container → sees /var/run/docker.sock → uses automount
  workflow container → gets /var/run/docker.sock mounted by runner

Also removed runner.envs (TCP+TLS approach) — unix socket is simpler
and works with automount.
---
 k8s/infra/forgejo-runner/templates/configmap.yaml  | 6 +-----
 k8s/infra/forgejo-runner/templates/deployment.yaml | 6 ++++++
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/k8s/infra/forgejo-runner/templates/configmap.yaml b/k8s/infra/forgejo-runner/templates/configmap.yaml
index c4519cf..30334e9 100644
--- a/k8s/infra/forgejo-runner/templates/configmap.yaml
+++ b/k8s/infra/forgejo-runner/templates/configmap.yaml
@@ -32,12 +32,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
 data:
   config.yaml: |
-    runner:
-      envs:
-        DOCKER_HOST: tcp://localhost:2376
-        DOCKER_TLS_VERIFY: "1"
-        DOCKER_CERT_PATH: /docker-certs/client
     container:
       valid_volumes:
         - /docker-certs/client
       network: host
+      docker_host: automount
diff --git a/k8s/infra/forgejo-runner/templates/deployment.yaml b/k8s/infra/forgejo-runner/templates/deployment.yaml
index 6b11c26..5412b78 100644
--- a/k8s/infra/forgejo-runner/templates/deployment.yaml
+++ b/k8s/infra/forgejo-runner/templates/deployment.yaml
@@ -70,6 +70,8 @@ spec:
               mountPath: /data
             - name: docker-certs
               mountPath: /docker-certs
+            - name: docker-sock
+              mountPath: /var/run
             - name: homelab-ca
               mountPath: /etc/ssl/certs/homelab-ca.pem
               subPath: ca.crt
@@ -89,6 +91,8 @@ spec:
           volumeMounts:
             - name: docker-certs
               mountPath: /docker-certs
+            - name: docker-sock
+              mountPath: /var/run
             - name: dind-storage
               mountPath: /var/lib/docker
             - name: homelab-ca
@@ -113,6 +117,8 @@ spec:
             claimName: {{ .Release.Name }}-dind
         - name: docker-certs
           emptyDir: {}    # DinD regenerates mTLS certs on each start
+        - name: docker-sock
+          emptyDir: {}    # Shared docker socket between dind and runner
         - name: homelab-ca
           # homelab-ca is a ConfigMap (public CA trust bundle), not a Secret.
           # The volumeMounts use subPath: ca.crt to project the single cert file.