From cfb1d88373eb112d7a10badf30c26e7ea9b9701a Mon Sep 17 00:00:00 2001 From: rock Date: Sun, 6 Sep 2026 07:09:40 -0700 Subject: [PATCH] fix: pass DOCKER_HOST + TLS env vars to workflow containers ROOT CAUSE: Workflow containers created by Forgejo runner don't inherit the DOCKER_HOST/TLS env vars from the runner pod. Docker CLI defaults to unix:///var/run/docker.sock which doesn't exist inside workflow containers. The dind sidecar listens on tcp://localhost:2376 with TLS. With network: host (already set), localhost inside the workflow container reaches the dind daemon. But docker CLI needs DOCKER_HOST set explicitly. FIX: Use runner.envs in config.yaml to pass these env vars to every workflow container: DOCKER_HOST=tcp://localhost:2376 DOCKER_TLS_VERIFY=1 DOCKER_CERT_PATH=/docker-certs/client The valid_volumes already allows /docker-certs/client (TLS certs). --- k8s/infra/forgejo-runner/templates/configmap.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/k8s/infra/forgejo-runner/templates/configmap.yaml b/k8s/infra/forgejo-runner/templates/configmap.yaml index c73d992..c4519cf 100644 --- a/k8s/infra/forgejo-runner/templates/configmap.yaml +++ b/k8s/infra/forgejo-runner/templates/configmap.yaml @@ -32,6 +32,11 @@ metadata: namespace: {{ .Release.Namespace }} data: config.yaml: | + runner: + envs: + DOCKER_HOST: tcp://localhost:2376 + DOCKER_TLS_VERIFY: "1" + DOCKER_CERT_PATH: /docker-certs/client container: valid_volumes: - /docker-certs/client