fix: wait for dind to be ready before starting runner daemon

fix: use tcp://localhost:2375 for dind (no TLS, no socket permission issues)
fix: run runner as root to access dind socket
2026-09-07 13:22:09 -07:00 · 2026-09-07 13:20:20 -07:00 · 2026-09-07 13:18:54 -07:00 · 2026-09-07 13:16:49 -07:00 · 2026-09-07 13:01:56 -07:00
5 changed files with 3 additions and 136 deletions
@@ -1,93 +0,0 @@
-name: Build & Push Runner Images
-
-on:
-  push:
-    branches: [main]
-  workflow_dispatch:  # Manual trigger
-  schedule:
-    - cron: '0 2 * * 0'  # Weekly on Sunday 2 AM UTC (ensure fresh images)
-
-env:
-  REGISTRY: forgejo.riotpiao.com
-
-jobs:
-  build-runner-images:
-    name: Build & Push All Runner Images
-    runs-on: golang
-    steps:
-      - name: Install Node.js and Docker
-        run: |
-          apt-get update
-          apt-get install -y nodejs docker.io
-
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Get short SHA
-        id: sha
-        run: |
-          SHORT_SHA=$(git rev-parse --short HEAD)
-          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
-
-      - name: Registry login
-        run: |
-          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
-            --username "${REGISTRY_USER}" --password-stdin
-        env:
-          REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
-          REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
-
-      - name: Build and push Golang runner image
-        run: |
-          IMAGE="${REGISTRY}/rock/forgejo-runner-golang"
-          echo "Building: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          
-          docker build --no-cache \
-            -f k8s/infra/forgejo-runner-images/Dockerfile.golang \
-            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE}:latest" \
-            .
-          
-          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          docker push "${IMAGE}:latest"
-          echo "✓ Pushed golang runner"
-
-      - name: Build and push Node runner image
-        run: |
-          IMAGE="${REGISTRY}/rock/forgejo-runner-node"
-          echo "Building: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          
-          docker build --no-cache \
-            -f k8s/infra/forgejo-runner-images/Dockerfile.node \
-            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE}:latest" \
-            .
-          
-          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          docker push "${IMAGE}:latest"
-          echo "✓ Pushed node runner"
-
-      - name: Build and push Rust runner image
-        run: |
-          IMAGE="${REGISTRY}/rock/forgejo-runner-rust"
-          echo "Building: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          
-          docker build --no-cache \
-            -f k8s/infra/forgejo-runner-images/Dockerfile.rust \
-            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE}:latest" \
-            .
-          
-          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          docker push "${IMAGE}:latest"
-          echo "✓ Pushed rust runner"
-
-      - name: Prune unused images
-        run: docker image prune -a --force 2>&1 | tail -3 || true
-
-      - name: Summary
-        run: |
-          echo "=== Runner Images Built and Pushed ===" 
-          echo "✓ forgejo.riotpiao.com/rock/forgejo-runner-golang:latest"
-          echo "✓ forgejo.riotpiao.com/rock/forgejo-runner-node:latest"
-          echo "✓ forgejo.riotpiao.com/rock/forgejo-runner-rust:latest"
@@ -1,12 +0,0 @@
-FROM golang:1.26-bookworm
-
-# Install Node.js, npm, and Docker CLI
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    nodejs npm docker.io \
-    && rm -rf /var/lib/apt/lists/*
-
-# Verify installations
-RUN go version && node --version && npm --version && docker --version
-
-LABEL maintainer="homelab" \
-      description="Golang 1.26 + Node.js + Docker CLI pre-installed"
@@ -1,12 +0,0 @@
-FROM node:22-bookworm
-
-# Node.js already installed, add Docker CLI
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    docker.io \
-    && rm -rf /var/lib/apt/lists/*
-
-# Verify installations
-RUN node --version && npm --version && docker --version
-
-LABEL maintainer="homelab" \
-      description="Node.js 22 + Docker CLI pre-installed"
@@ -1,12 +0,0 @@
-FROM rust:1-bookworm
-
-# Add Node.js and Docker CLI
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    nodejs npm docker.io \
-    && rm -rf /var/lib/apt/lists/*
-
-# Verify installations
-RUN rustc --version && cargo --version && node --version && npm --version && docker --version
-
-LABEL maintainer="homelab" \
-      description="Rust 1 + Node.js + Docker CLI pre-installed"
@@ -60,15 +60,11 @@ spec:
      containers:
        - name: runner
          image: {{ .Values.runner.image.repository }}:{{ .Values.runner.image.tag }}
-          command: ["sh", "-c", "forgejo-runner daemon --config /etc/forgejo-runner/config.yaml"]
+          command: ["sh", "-c", "while ! wget -q -O- http://localhost:2375/_ping >/dev/null 2>&1; do echo 'waiting for dind...'; sleep 2; done; echo 'dind ready'; forgejo-runner daemon --config /etc/forgejo-runner/config.yaml"]
          workingDir: /data
          env:
            - name: DOCKER_HOST
-              value: tcp://localhost:2376
-            - name: DOCKER_TLS_VERIFY
-              value: "1"
-            - name: DOCKER_CERT_PATH
-              value: /docker-certs/client
+              value: tcp://localhost:2375
          volumeMounts:
            - name: runner-data
              mountPath: /data
@@ -91,7 +87,7 @@ spec:
            privileged: true    # required for DinD; cicd namespace is labelled privileged
          env:
            - name: DOCKER_TLS_CERTDIR
-              value: /docker-certs
+              value: ""
          volumeMounts:
            - name: docker-certs
              mountPath: /docker-certs
Author	SHA1	Message	Date
rock	e28e3cae81	fix: wait for dind to be ready before starting runner daemon	2026-09-07 13:22:09 -07:00
rock	febfb055ae	fix: use tcp://localhost:2375 for dind (no TLS, no socket permission issues)	2026-09-07 13:20:20 -07:00
rock	9d61c42b99	fix: run runner as root to access dind socket	2026-09-07 13:18:54 -07:00
rock	594e752d47	fix: runner uses unix socket instead of TLS TCP for dind Job containers spawned by the runner run inside dind. With TCP+TLS (tcp://localhost:2376), localhost inside those containers doesn't reach the dind sidecar. Unix socket at /run/docker.sock works because both runner and dind share the /run emptyDir. Also disables DOCKER_TLS_CERTDIR so dind creates the socket instead of only listening on TLS TCP.	2026-09-07 13:16:49 -07:00
rock	1a8e87131b	ci: fix runner labels + CoreDNS rewrite + cleanup - Runners use public images (code.forgejo.org/forgejo/runner:6) - Labels pull from Docker Hub: golang:1.26, node:22, rust:1-bookworm - Add CoreDNS api.riotpiao.com rewrite - Fix runner re-registration to keep labels in sync - Add unified CI pattern docs to CLAUDE.example.md - Remove dead .forgejo/ workflow dir (Forgejo uses .gitea/)	2026-09-07 13:01:56 -07:00