feat: migrate Forgejo runner to StatefulSet with Docker-in-Docker

Replaces the Deployment-based runner with a StatefulSet using a proper
Docker-in-Docker sidecar for improved isolation and state management.

Key changes:
- StatefulSet deployment for stable pod identity and persistent storage
- Docker-in-Docker init container (privileged) providing isolated Docker daemon
- Two persistent volumes: runner-data (1Gi) for config, docker-data (20Gi) for image cache
- Uses hcloud-volumes storage class for durability
- Each replica gets its own Docker daemon and image cache

This addresses the workflow failure where job containers (node:24-bookworm)
couldn't access Docker because the CLI was missing. The DinD sidecar provides
a complete Docker environment for all job containers.

Fixes: DEV-335

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/forgejo-runner/README.md

@@ -50,11 +50,17 @@ kubectl apply -f apps/app-forgejo-runner.yaml
 
 ## Runner Configuration
 
-The runner is configured to:
-- Run 2 concurrent jobs
-- Use Docker-in-Docker for workflow execution
-- Support ubuntu-latest and ubuntu-22.04 labels with Node.js 24
-- Connect to Forgejo at http://forgejo.forgejo.svc.cluster.local:3000
+The runner is deployed as a StatefulSet with Docker-in-Docker (dind) sidecar for proper isolation and state management.
+
+Configuration:
+- **Deployment type**: StatefulSet (stable pod identity, persistent storage)
+- **Docker execution**: Docker-in-Docker sidecar (privileged init container)
+- **Concurrent jobs**: 2 (configurable via config.yaml)
+- **Labels**: ubuntu-latest:docker://node:24-bookworm, ubuntu-22.04:docker://node:24-bookworm
+- **Forgejo URL**: https://forgejo.basicstack.de (external URL for proper webhook/API access)
+- **Persistent volumes**:
+  - runner-data (1Gi): Runner registration and config
+  - docker-data (20Gi): Docker image cache
 
 ## Troubleshooting
 

apps/forgejo-runner/forgejo-runner-statefulset.yaml

@@ -1,9 +1,10 @@
 apiVersion: apps/v1
-kind: Deployment
+kind: StatefulSet
 metadata:
   name: forgejo-runner
   namespace: forgejo
 spec:
+  serviceName: forgejo-runner
   replicas: 1
   selector:
     matchLabels:
@@ -13,24 +14,55 @@ spec:
       labels:
         app: forgejo-runner
     spec:
+      restartPolicy: Always
       serviceAccountName: forgejo-runner
+      volumes:
+      - name: docker-socket
+        emptyDir: {}
+      - name: config
+        configMap:
+          name: forgejo-runner-config
+      initContainers:
+      - name: docker
+        image: docker:28-dind
+        securityContext:
+          privileged: true
+        volumeMounts:
+        - name: docker-socket
+          mountPath: /var/run
+        - name: docker-data
+          mountPath: /var/lib/docker
+        startupProbe:
+          exec:
+            command: ["/usr/bin/test", "-S", "/var/run/docker.sock"]
+          initialDelaySeconds: 5
+          periodSeconds: 2
+          failureThreshold: 30
+        livenessProbe:
+          exec:
+            command: ["/usr/bin/test", "-S", "/var/run/docker.sock"]
+          periodSeconds: 10
+        restartPolicy: Always
       containers:
       - name: runner
         image: code.forgejo.org/forgejo/runner:4.0.1
         imagePullPolicy: IfNotPresent
-        securityContext:
-          runAsUser: 0
-          runAsGroup: 0
         command:
         - sh
         - -c
         - |
-          # Wait for Forgejo to be ready (external URL)
+          # Wait for Forgejo to be ready
           while ! wget -q -O- https://forgejo.basicstack.de/api/healthz > /dev/null 2>&1; do
             echo "Waiting for Forgejo to be ready..."
             sleep 5
           done
 
+          # Wait for Docker daemon to be ready
+          while ! docker version > /dev/null 2>&1; do
+            echo "Waiting for Docker daemon to be ready..."
+            sleep 2
+          done
+
           # Re-register if the stored address is the internal cluster URL
           if [ -f /data/.runner ] && grep -q "svc.cluster.local" /data/.runner; then
             echo "Detected internal cluster URL in .runner — forcing re-registration with external URL"
@@ -43,7 +75,7 @@ spec:
               --no-interactive \
               --instance https://forgejo.basicstack.de \
               --token "$RUNNER_TOKEN" \
-              --name k3s-runner-1 \
+              --name "k3s-dind-runner-${HOSTNAME##*-}" \
               --labels ubuntu-latest:docker://node:24-bookworm,ubuntu-22.04:docker://node:24-bookworm
           fi
 
@@ -58,26 +90,35 @@ spec:
         - name: DOCKER_HOST
           value: unix:///var/run/docker.sock
         volumeMounts:
-        - name: docker-sock
-          mountPath: /var/run/docker.sock
         - name: runner-data
           mountPath: /data
+        - name: docker-socket
+          mountPath: /var/run
         - name: config
           mountPath: /etc/forgejo-runner
         resources:
           requests:
-            cpu: 100m
-            memory: 256Mi
+            cpu: 200m
+            memory: 512Mi
           limits:
-            cpu: "2"
-            memory: 2Gi
-      volumes:
-      - name: docker-sock
-        hostPath:
-          path: /var/run/docker.sock
-          type: Socket
-      - name: runner-data
-        emptyDir: {}
-      - name: config
-        configMap:
-          name: forgejo-runner-config
+            cpu: "4"
+            memory: 4Gi
+  volumeClaimTemplates:
+  - metadata:
+      name: runner-data
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 1Gi
+      storageClassName: hcloud-volumes
+  - metadata:
+      name: docker-data
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 20Gi
+      storageClassName: hcloud-volumes