Rolling OS updates removed docker.io from all workers, breaking the
runner's hostPath mount of /var/run/docker.sock (type=Socket check).
- Install docker.io on all 5 worker nodes and enable the systemd unit.
- Label the nodes basicstack.de/docker=true so the dependency is explicit.
- Add nodeSelector to the Deployment so scheduling fails fast on
non-labeled nodes instead of hanging in ContainerCreating.
- Document the node prerequisite in the README.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
dind sidecar had networking issue: host-networked job containers can't reach
the dind daemon inside the pod. Back to host socket with docker binary
bind-mounted into job containers via container.options.
Replaces the Deployment-based runner with a StatefulSet using a proper
Docker-in-Docker sidecar for improved isolation and state management.
Key changes:
- StatefulSet deployment for stable pod identity and persistent storage
- Docker-in-Docker init container (privileged) providing isolated Docker daemon
- Two persistent volumes: runner-data (1Gi) for config, docker-data (20Gi) for image cache
- Uses hcloud-volumes storage class for durability
- Each replica gets its own Docker daemon and image cache
This addresses the workflow failure where job containers (node:24-bookworm)
couldn't access Docker because the CLI was missing. The DinD sidecar provides
a complete Docker environment for all job containers.
Fixes: DEV-335
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Docker containers launched by the runner on the host cannot resolve
forgejo.forgejo.svc.cluster.local (k8s cluster DNS is not available
from host Docker containers). Switching to https://forgejo.basicstack.de
for runner registration so GITHUB_SERVER_URL in job context uses the
externally reachable URL, fixing git fetch in actions/checkout.
Also adds detection to force re-registration if a pod starts with the
old internal-URL .runner file still present.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Run the forgejo-runner container as root (uid 0) to allow access to the
Docker socket. This is required for Docker-in-Docker functionality needed
by Forgejo Actions workflows.
Without this, the runner fails with "permission denied" when trying to
access /var/run/docker.sock.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Create runner deployment with:
- ServiceAccount and RBAC for runner pod
- ConfigMap for runner configuration
- Deployment using code.forgejo.org/forgejo/runner:4.0.1
- Argo CD application for automated deployment
Note: Runner requires a sealed secret with registration token.
See apps/forgejo-runner/README.md for setup instructions.
Part of DEV-334 CI/CD workflow implementation.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
