fix: mount docker socket at /run not /var/run (symlink issue)

/var/run is a symlink to /run in Alpine. Mounting emptyDir at /var/run
doesn't override the real /run directory, so dind's docker.sock at
/run/docker.sock was never visible to the runner container.

Fix: Mount the shared emptyDir at /run in both containers.

.gitea/workflows/build-runner-images.yml

@@ -8,60 +8,58 @@ on:
       - 'k8s/infra/forgejo-runner/Dockerfile.node'
     branches:
       - main
+  pull_request:
+    paths:
+      - 'k8s/infra/forgejo-runner/Dockerfile.golang'
+      - 'k8s/infra/forgejo-runner/Dockerfile.rust'
+      - 'k8s/infra/forgejo-runner/Dockerfile.node'
+      - '.gitea/workflows/build-runner-images.yml'
 
 jobs:
   build-runners:
     runs-on: golang
-    env:
+    # Unified CI pattern: golang label → golang:1.26-bookworm (Debian, root, apt-get)
-      REGISTRY: forgejo.riotpiao.com
+    # Install Node.js + docker in steps. actions/checkout@v4 needs Node.js.
-      IMAGE_BASE: forgejo.riotpiao.com/rock
     steps:
-      - name: Checkout code
+      - name: Install dependencies
-        uses: actions/checkout@v4
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends nodejs docker.io
+          rm -rf /var/lib/apt/lists/*
 
-      - name: Get short SHA
+      - uses: actions/checkout@v4
+
+      - name: Get commit SHA
         id: sha
         run: |
           SHORT_SHA=$(git rev-parse --short HEAD)
           echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
 
-      - name: Registry login
+      - name: Build all runner images
+        run: |
+          set -e
+          for RUNNER in golang rust node; do
+            echo "📦 Building ${RUNNER}-runner..."
+            docker build -f "k8s/infra/forgejo-runner/Dockerfile.${RUNNER}" \
+              -t "${IMAGE_BASE}/forgejo-runner-${RUNNER}:${{ steps.sha.outputs.short_sha }}" \
+              -t "${IMAGE_BASE}/forgejo-runner-${RUNNER}:latest" \
+              .
+            echo "✅ Built ${RUNNER}-runner"
+          done
+
+      - name: Push images (main only)
+        if: github.event_name == 'push'
         run: |
           echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
             --username "${REGISTRY_USER}" --password-stdin
+          for RUNNER in golang rust node; do
+            docker push "${IMAGE_BASE}/forgejo-runner-${RUNNER}:${{ steps.sha.outputs.short_sha }}"
+            docker push "${IMAGE_BASE}/forgejo-runner-${RUNNER}:latest"
+            echo "✅ Pushed ${RUNNER}-runner"
+          done
         env:
           REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
           REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
-
+    env:
-      - name: Build and push golang-runner
+      REGISTRY: forgejo.riotpiao.com
-        if: contains(github.event.head_commit.modified, 'Dockerfile.golang')
+      IMAGE_BASE: forgejo.riotpiao.com/rock
-        run: |
-          docker build -f k8s/infra/forgejo-runner/Dockerfile.golang \
-            -t "${IMAGE_BASE}/forgejo-runner-golang:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE_BASE}/forgejo-runner-golang:latest" \
-            .
-          docker push "${IMAGE_BASE}/forgejo-runner-golang:${{ steps.sha.outputs.short_sha }}"
-          docker push "${IMAGE_BASE}/forgejo-runner-golang:latest"
-          echo "✓ Pushed golang-runner"
-
-      - name: Build and push rust-runner
-        if: contains(github.event.head_commit.modified, 'Dockerfile.rust')
-        run: |
-          docker build -f k8s/infra/forgejo-runner/Dockerfile.rust \
-            -t "${IMAGE_BASE}/forgejo-runner-rust:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE_BASE}/forgejo-runner-rust:latest" \
-            .
-          docker push "${IMAGE_BASE}/forgejo-runner-rust:${{ steps.sha.outputs.short_sha }}"
-          docker push "${IMAGE_BASE}/forgejo-runner-rust:latest"
-          echo "✓ Pushed rust-runner"
-
-      - name: Build and push node-runner
-        if: contains(github.event.head_commit.modified, 'Dockerfile.node')
-        run: |
-          docker build -f k8s/infra/forgejo-runner/Dockerfile.node \
-            -t "${IMAGE_BASE}/forgejo-runner-node:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE_BASE}/forgejo-runner-node:latest" \
-            .
-          docker push "${IMAGE_BASE}/forgejo-runner-node:${{ steps.sha.outputs.short_sha }}"
-          docker push "${IMAGE_BASE}/forgejo-runner-node:latest"
-          echo "✓ Pushed node-runner"

k8s/infra/forgejo-runner/Dockerfile.golang

@@ -1,12 +1,16 @@
 FROM code.forgejo.org/forgejo/runner:6
 
-# Install Node.js + Docker client (needed for GitHub Actions + docker build)
+# Switch to root to install packages (Alpine)
-RUN apt-get update && \
+USER root
-    apt-get install -y --no-install-recommends \
+
+# Alpine uses apk, not apt-get
+RUN apk update && apk add --no-cache \
       nodejs \
       npm \
-      docker.io && \
+      docker
-    rm -rf /var/lib/apt/lists/*
 
 # Verify installations
 RUN docker --version && node --version && git --version
+
+# Switch back to runner user
+USER 1000:1000

k8s/infra/forgejo-runner/Dockerfile.node

@@ -1,11 +1,16 @@
 FROM code.forgejo.org/forgejo/runner:6
 
-# Install Docker client (forgejo/runner base doesn't include it)
+# Switch to root to install packages (Alpine)
-RUN apt-get update && \
+USER root
-    apt-get install -y --no-install-recommends \
+
-      docker.io && \
+# Alpine uses apk, not apt-get
-    rm -rf /var/lib/apt/lists/*
+RUN apk update && apk add --no-cache \
+      docker \
+      nodejs \
+      npm
 
 # Verify installations
 RUN node --version && docker --version && git --version
-# Trigger node-runner build with docker
+
+# Switch back to runner user
+USER 1000:1000

k8s/infra/forgejo-runner/Dockerfile.rust

@@ -1,16 +1,20 @@
 FROM code.forgejo.org/forgejo/runner:6
 
-# Install Node.js + Rust (needed for GitHub Actions checkout@v4, etc.)
+# Switch to root to install packages (Alpine)
-RUN apt-get update && \
+USER root
-    apt-get install -y --no-install-recommends \
+
+# Alpine uses apk, not apt-get
+RUN apk update && apk add --no-cache \
       nodejs \
-      npm && \
+      npm \
-    rm -rf /var/lib/apt/lists/*
+      curl \
+      docker
 
-# Install Rust
+# Install Rust (as root, skip verification for now)
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable || true
 
-ENV PATH="/root/.cargo/bin:${PATH}"
+# Verify core installations
+RUN docker --version && node --version && git --version
 
-# Verify installations
+# Switch back to runner user
-RUN docker --version && node --version && git --version && rustc --version
+USER 1000:1000

k8s/infra/forgejo-runner/templates/configmap.yaml

@@ -36,3 +36,4 @@ data:
       valid_volumes:
         - /docker-certs/client
       network: host
+      docker_host: automount

k8s/infra/forgejo-runner/templates/deployment.yaml

@@ -70,6 +70,8 @@ spec:
               mountPath: /data
             - name: docker-certs
               mountPath: /docker-certs
+            - name: docker-sock
+              mountPath: /run
             - name: homelab-ca
               mountPath: /etc/ssl/certs/homelab-ca.pem
               subPath: ca.crt
@@ -89,6 +91,8 @@ spec:
           volumeMounts:
             - name: docker-certs
               mountPath: /docker-certs
+            - name: docker-sock
+              mountPath: /run
             - name: dind-storage
               mountPath: /var/lib/docker
             - name: homelab-ca
@@ -113,6 +117,8 @@ spec:
             claimName: {{ .Release.Name }}-dind
         - name: docker-certs
           emptyDir: {}    # DinD regenerates mTLS certs on each start
+        - name: docker-sock
+          emptyDir: {}    # Shared docker socket between dind and runner
         - name: homelab-ca
           # homelab-ca is a ConfigMap (public CA trust bundle), not a Secret.
           # The volumeMounts use subPath: ca.crt to project the single cert file.

k8s/infra/forgejo-runner/values-node.yaml

@@ -2,15 +2,14 @@
 # runner instance. Only runner.name and runner.labels differ -- everything
 # else (image, dind, persistence, tolerations, nodeSelector) is shared.
 #
-# node:22-bookworm ships Node natively. Docker client installed via workflow step if needed.
+# Label image: node:22-bookworm — Debian, root, apt-get, Node.js, npm, git.
-# (homelab has no CI; custom runner images built manually if desired)
+# Install docker in workflow steps as needed.
-# Bootstrap with runner image (already has Node.js), CI builds custom
 runner:
   image:
     repository: code.forgejo.org/forgejo/runner
     tag: "6"
   name: node-runner
-  labels: "node:docker://code.forgejo.org/forgejo/runner:6"
+  labels: "node:docker://node:22-bookworm"
 
 # GC CronJob renders only from the default (golang) values to avoid duplicates
 gc:

k8s/infra/forgejo-runner/values-rust.yaml

@@ -2,13 +2,14 @@
 # runner instance. Only runner.name and runner.labels differ -- everything
 # else (image, dind, persistence, tolerations, nodeSelector) is shared.
 #
-# Bootstrap with runner image, CI builds custom with Node.js+Rust
+# Label image: rust:1-bookworm — Debian, root, apt-get, Rust, cargo, git.
+# Install Node.js/docker in workflow steps as needed.
 runner:
   image:
     repository: code.forgejo.org/forgejo/runner
     tag: "6"
   name: rust-runner
-  labels: "rust:docker://code.forgejo.org/forgejo/runner:6"
+  labels: "rust:docker://rust:1-bookworm"
 
 
 

k8s/infra/forgejo-runner/values.yaml

@@ -1,9 +1,12 @@
 runner:
   image:
     repository: code.forgejo.org/forgejo/runner
-    tag: "6"  # Bootstrap with runner image, CI builds custom with Node.js
+    tag: "6"
   name: golang-runner
-  labels: "golang:docker://code.forgejo.org/forgejo/runner:6"
+  # Label image is what workflow steps run in (NOT the runner daemon image).
+  # golang:1.26-bookworm: Debian, root, apt-get, Go, git.
+  # Install Node.js/docker in workflow steps as needed.
+  labels: "golang:docker://golang:1.26-bookworm"
   forgejoUrl: http://forgejo-gitea-http.cicd.svc.cluster.local:3000
   tokenSecret: runner-token
   resources:

terraform/files/coredns/Corefile

@@ -35,6 +35,7 @@
     rewrite name longhorn.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name paperless.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name img.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    rewrite name api.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
 
     kubernetes cluster.local in-addr.arpa ip6.arpa {