rock/homelab
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity
371 Commits 4 Branches 0 Tags
ba0b3c2b645ea5f87253b3506a8be42674e982bd
Commit Graph
4 Commits
Author SHA1 Message Date
rock ce154c55e6 fix: share docker socket between dind and runner via emptyDir
Build and push runner images / build-runners (pull_request) Failing after 40s
Details 
ROOT CAUSE: Docker socket (/var/run/docker.sock) only existed inside the
dind container — the runner container couldn't see it. The runner connected
to dind via TCP (tcp://localhost:2376) with TLS. But workflow containers
created by the runner had NO way to access the docker daemon:
- unix socket not mounted (runner can't see it)
- DOCKER_HOST env var not passed (runner.envs not configured)

FIX: Share /var/run between dind and runner via emptyDir volume.
When dind starts, it creates /var/run/docker.sock in the shared volume.
Runner can now see the socket. docker_host: automount in config tells
the runner to mount the socket into job containers automatically.

Architecture after fix:
  dind container → creates /var/run/docker.sock → shared emptyDir
  runner container → sees /var/run/docker.sock → uses automount
  workflow container → gets /var/run/docker.sock mounted by runner

Also removed runner.envs (TCP+TLS approach) — unix socket is simpler
and works with automount.
 2026-09-06 07:15:01 -07:00
rock cfb1d88373 fix: pass DOCKER_HOST + TLS env vars to workflow containers
Build and push runner images / build-runners (pull_request) Failing after 38s
Details 
ROOT CAUSE: Workflow containers created by Forgejo runner don't inherit
the DOCKER_HOST/TLS env vars from the runner pod. Docker CLI defaults to
unix:///var/run/docker.sock which doesn't exist inside workflow containers.

The dind sidecar listens on tcp://localhost:2376 with TLS. With
network: host (already set), localhost inside the workflow container
reaches the dind daemon. But docker CLI needs DOCKER_HOST set explicitly.

FIX: Use runner.envs in config.yaml to pass these env vars to every
workflow container:
  DOCKER_HOST=tcp://localhost:2376
  DOCKER_TLS_VERIFY=1
  DOCKER_CERT_PATH=/docker-certs/client

The valid_volumes already allows /docker-certs/client (TLS certs).
 2026-09-06 07:09:40 -07:00
Story Crater Bot 7234eb596f fix(forgejo-runner): job containers must use host network to reach dind 2026-08-21 16:22:19 -07:00
Story Crater Bot c46e69fd43 fix(forgejo-runner): allow job containers to mount /docker-certs/client so docker login/build/push work 2026-08-21 16:22:19 -07:00