fix: wait for dind to be ready before starting runner daemon

fix: use tcp://localhost:2375 for dind (no TLS, no socket permission issues)
fix: run runner as root to access dind socket
2026-09-07 13:22:09 -07:00 · 2026-09-07 13:20:20 -07:00 · 2026-09-07 13:18:54 -07:00 · 2026-09-07 13:16:49 -07:00 · 2026-09-07 13:01:56 -07:00
1 changed files with 3 additions and 7 deletions
@@ -60,15 +60,11 @@ spec:
      containers:
        - name: runner
          image: {{ .Values.runner.image.repository }}:{{ .Values.runner.image.tag }}
-          command: ["sh", "-c", "forgejo-runner daemon --config /etc/forgejo-runner/config.yaml"]
+          command: ["sh", "-c", "while ! wget -q -O- http://localhost:2375/_ping >/dev/null 2>&1; do echo 'waiting for dind...'; sleep 2; done; echo 'dind ready'; forgejo-runner daemon --config /etc/forgejo-runner/config.yaml"]
          workingDir: /data
          env:
            - name: DOCKER_HOST
-              value: tcp://localhost:2376
-            - name: DOCKER_TLS_VERIFY
-              value: "1"
-            - name: DOCKER_CERT_PATH
-              value: /docker-certs/client
+              value: tcp://localhost:2375
          volumeMounts:
            - name: runner-data
              mountPath: /data
@@ -91,7 +87,7 @@ spec:
            privileged: true    # required for DinD; cicd namespace is labelled privileged
          env:
            - name: DOCKER_TLS_CERTDIR
-              value: /docker-certs
+              value: ""
          volumeMounts:
            - name: docker-certs
              mountPath: /docker-certs
Author	SHA1	Message	Date
rock	e28e3cae81	fix: wait for dind to be ready before starting runner daemon	2026-09-07 13:22:09 -07:00
rock	febfb055ae	fix: use tcp://localhost:2375 for dind (no TLS, no socket permission issues)	2026-09-07 13:20:20 -07:00
rock	9d61c42b99	fix: run runner as root to access dind socket	2026-09-07 13:18:54 -07:00
rock	594e752d47	fix: runner uses unix socket instead of TLS TCP for dind Job containers spawned by the runner run inside dind. With TCP+TLS (tcp://localhost:2376), localhost inside those containers doesn't reach the dind sidecar. Unix socket at /run/docker.sock works because both runner and dind share the /run emptyDir. Also disables DOCKER_TLS_CERTDIR so dind creates the socket instead of only listening on TLS TCP.	2026-09-07 13:16:49 -07:00
rock	1a8e87131b	ci: fix runner labels + CoreDNS rewrite + cleanup - Runners use public images (code.forgejo.org/forgejo/runner:6) - Labels pull from Docker Hub: golang:1.26, node:22, rust:1-bookworm - Add CoreDNS api.riotpiao.com rewrite - Fix runner re-registration to keep labels in sync - Add unified CI pattern docs to CLAUDE.example.md - Remove dead .forgejo/ workflow dir (Forgejo uses .gitea/)	2026-09-07 13:01:56 -07:00