phil/ansible
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Take the Docker socket away from the Gitea runner

Browse Source 
Jobs run inside the runner container (label docker:host), and with the
host's Docker socket mounted every workflow had root on the server. The
socket was only there for StarPunk's image build, which has never worked
(it logged in to gitea:3000, which the host daemon can't resolve).

Image builds now go to a rootless BuildKit container that shares only a
unix socket with the runner. Site builds keep their /sites mount.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Phil
2026-10-31 12:01:06 -06:00
co-authored by Claude Opus 5.5
parent 6dfb58d3f1
commit a6592d3ad0
3 changed files with 25 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/docker/README.md
+1 -1
View File
@@ -31,7 +31,7 @@ Tags: each category file has a category tag, each service its own tag.
### Development (`development`)
| Tag | Service | Notes |
|---|---|---|
| `gitea` | Gitea + act_runner | Fixed IP 172.20.0.6 so the ufw-docker rule for SSH (host port 222) stays valid. Pocket ID login is set up in Gitea's admin UI; OpenID 2.0 login is off. |
| `gitea` | Gitea + act_runner + BuildKit | Fixed IP 172.20.0.6 so the ufw-docker rule for SSH (host port 222) stays valid. Pocket ID login is set up in Gitea's admin UI; OpenID 2.0 login is off. Jobs run inside the runner container (label `docker:host`), which has the Caddy site folders at `/sites` but no Docker socket. Image builds use the rootless `buildkitd` container through `unix:///run/buildkit/buildkit/buildkitd.sock` (`docker buildx create --driver remote`). |
| `bytestash` | ByteStash | Pocket ID through env vars. |
### Media (`media`)