# act_runner (the forgejo-runner binary) ships no config.yaml by default, so
# `forgejo-runner daemon` runs on its hardcoded defaults -- notably
# container.valid_volumes: [] ("if the sequence is empty, no volumes can be
# mounted"). Confirmed via `forgejo-runner generate-config` on this exact
# image (code.forgejo.org/forgejo/runner:6) and by running the daemon against
# a minimal override locally: a job container that requests any bind mount
# (e.g. the dind mTLS certs at /docker-certs/client, needed for
# `docker login`/build/push steps) is rejected outright with no default
# config in place.
#
# Scoped narrowly to exactly the certs path, read-only. Not a wildcard
# (valid_volumes: ['**']) -- that would let any workflow in any repo this
# runner serves bind-mount arbitrary paths off the runner pod's filesystem
# into a job container, which is a real widening of the CI trust boundary,
# not just a convenience.
#
# network: host is also only settable here, not per-workflow. A workflow's
# `container.options: --network host` is silently ignored -- confirmed live:
# every job's actual `docker create` call logged
# `network="FORGEJO-ACTIONS-TASK-N_..."`, an auto-generated per-job bridge,
# regardless of that options string. On that isolated bridge, DOCKER_HOST=
# tcp://localhost:2376 resolves to the job container itself (no daemon there),
# not to the dind sidecar, so any docker command that actually needs the
# daemon (build, push -- anything past docker login, which only talks to the
# registry over the network and never touches DOCKER_HOST) fails with "Cannot
# connect to the Docker daemon". host mode puts every job container in dind's
# own network namespace instead, where the daemon really is listening.
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ .Release.Name }}-config
  namespace: {{ .Release.Namespace }}
data:
  config.yaml: |
    container:
      valid_volumes:
        - /docker-certs/client
      network: host