fix: revert to Deployment with host Docker socket (dind approach abandoned)

dind sidecar had networking issue: host-networked job containers can't reach
the dind daemon inside the pod. Back to host socket with docker binary
bind-mounted into job containers via container.options.

apps/forgejo-runner/forgejo-runner-deployment.yaml

@@ -1,10 +1,9 @@
 apiVersion: apps/v1
-kind: StatefulSet
+kind: Deployment
 metadata:
   name: forgejo-runner
   namespace: forgejo
 spec:
-  serviceName: forgejo-runner
   replicas: 1
   selector:
     matchLabels:
@@ -14,58 +13,24 @@ spec:
       labels:
         app: forgejo-runner
     spec:
-      restartPolicy: Always
       serviceAccountName: forgejo-runner
-      volumes:
-      - name: docker-socket
-        emptyDir: {}
-      - name: config
-        configMap:
-          name: forgejo-runner-config
-      initContainers:
-      - name: docker
-        image: docker:28-dind
-        securityContext:
-          privileged: true
-        volumeMounts:
-        - name: docker-socket
-          mountPath: /var/run
-        - name: docker-data
-          mountPath: /var/lib/docker
-        startupProbe:
-          exec:
-            command: ["/usr/bin/test", "-S", "/var/run/docker.sock"]
-          initialDelaySeconds: 5
-          periodSeconds: 2
-          failureThreshold: 30
-        livenessProbe:
-          exec:
-            command: ["/usr/bin/test", "-S", "/var/run/docker.sock"]
-          periodSeconds: 10
-        restartPolicy: Always
       containers:
       - name: runner
         image: code.forgejo.org/forgejo/runner:4.0.1
         imagePullPolicy: IfNotPresent
+        securityContext:
+          runAsUser: 0
+          runAsGroup: 0
         command:
         - sh
         - -c
         - |
-          # Install Docker CLI
+          # Wait for Forgejo to be ready (external URL)
-          apk add --no-cache docker-cli
-
-          # Wait for Forgejo to be ready
           while ! wget -q -O- https://forgejo.basicstack.de/api/healthz > /dev/null 2>&1; do
             echo "Waiting for Forgejo to be ready..."
             sleep 5
           done
 
-          # Wait for Docker daemon to be ready
-          while ! docker version > /dev/null 2>&1; do
-            echo "Waiting for Docker daemon to be ready..."
-            sleep 2
-          done
-
           # Re-register if the stored address is the internal cluster URL
           if [ -f /data/.runner ] && grep -q "svc.cluster.local" /data/.runner; then
             echo "Detected internal cluster URL in .runner — forcing re-registration with external URL"
@@ -78,7 +43,7 @@ spec:
               --no-interactive \
               --instance https://forgejo.basicstack.de \
               --token "$RUNNER_TOKEN" \
-              --name "k3s-dind-runner-${HOSTNAME##*-}" \
+              --name k3s-runner-1 \
               --labels ubuntu-latest:docker://node:24-bookworm,ubuntu-22.04:docker://node:24-bookworm
           fi
 
@@ -93,35 +58,26 @@ spec:
         - name: DOCKER_HOST
           value: unix:///var/run/docker.sock
         volumeMounts:
+        - name: docker-sock
+          mountPath: /var/run/docker.sock
         - name: runner-data
           mountPath: /data
-        - name: docker-socket
-          mountPath: /var/run
         - name: config
           mountPath: /etc/forgejo-runner
         resources:
           requests:
-            cpu: 200m
+            cpu: 100m
-            memory: 512Mi
+            memory: 256Mi
           limits:
-            cpu: "4"
+            cpu: "2"
-            memory: 4Gi
+            memory: 2Gi
-  volumeClaimTemplates:
+      volumes:
-  - metadata:
+      - name: docker-sock
-      name: runner-data
+        hostPath:
-    spec:
+          path: /var/run/docker.sock
-      accessModes:
+          type: Socket
-      - ReadWriteOnce
+      - name: runner-data
-      resources:
+        emptyDir: {}
-        requests:
+      - name: config
-          storage: 1Gi
+        configMap:
-      storageClassName: hcloud-volumes
+          name: forgejo-runner-config
-  - metadata:
-      name: docker-data
-    spec:
-      accessModes:
-      - ReadWriteOnce
-      resources:
-        requests:
-          storage: 20Gi
-      storageClassName: hcloud-volumes