forgejo: runner rootless dind (v3)

Author: jaredallard

manifests/apps/by-cluster/rgst/forgejo.jsonnet

@@ -138,6 +138,22 @@ local all = {
       redis: { enabled: true },
     },
   ),
+  runner_config: k.ConfigMap(name + '-runner-config', namespace) {
+    data_:: {
+      'config.yaml': std.manifestYamlDoc({
+        runner: {
+          // Generated by the registration init container.
+          file: '.runner',
+        },
+        container: {
+          valid_volumes: ['**'],
+          force_pull: true,  // TODO(jaredallard): Periodic re-pull?
+          // Expose our socket into the container.
+          options: '-v /run/docker/docker.sock:/var/run/docker.sock:ro',
+        },
+      }),
+    },
+  },
   runner: k._Object('apps/v1', 'StatefulSet', name + '-runner', namespace) {
     spec: {
       replicas: 2,
@@ -160,7 +176,12 @@ local all = {
               emptyDir: {},
             }
             for name in ['dind-sock', 'dind-etc', 'dind-home', 'runner-data']
-          ],
+          ] + [{
+            name: 'runner-config',
+            configMap: {
+              name: all.runner_config.metadata.name,
+            },
+          }],
           local dind_sock_dir = '/run/docker',
           local dind_sock = dind_sock_dir + '/docker.sock',
           initContainers: [
@@ -180,20 +201,11 @@ local all = {
                 '--labels',
                 'ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest',
               ],
-              env: [
-                {
-                  name: 'RUNNER_NAME',
-                  valueFrom: { fieldRef: { fieldPath: 'metadata.name' } },
-                },
-                {
-                  name: 'RUNNER_SECRET',
-                  valueFrom: { secretKeyRef: { name: $.external_secret.metadata.name, key: 'RUNNER_SECRET' } },
-                },
-                {
-                  name: 'FORGEJO_INSTANCE_URL',
-                  value: 'http://forgejo-http.forgejo.svc.cluster.local:3000',
-                },
-              ],
+              env: k.envList({
+                RUNNER_NAME: { fieldRef: { fieldPath: 'metadata.name' } },
+                RUNNER_SECRET: { secretKeyRef: { name: $.external_secret.metadata.name, key: 'RUNNER_SECRET' } },
+                FORGEJO_INSTANCE_URL: 'http://forgejo-http.forgejo.svc.cluster.local:3000',
+              }),
               resources: {
                 limits: {
                   cpu: 4,
@@ -209,34 +221,6 @@ local all = {
                 mountPath: '/data',
               }],
             },
-            {
-              name: 'setup-dind',
-              image: 'docker:28.0.1-dind-rootless',
-              command: ['sh', '-ex', '-c'],
-              args: [
-                |||
-                  cp -a /etc/. /dind-etc/
-                  echo 'runner:x:1000:1000:runner:/home/runner:/bin/ash' >> /dind-etc/passwd
-                  echo 'runner:x:1000:' >> /dind-etc/group
-                  echo 'runner:100000:65536' >> /dind-etc/subgid
-                  echo 'runner:100000:65536' >>  /dind-etc/subuid
-                  chmod 755 /dind-etc;
-                  chmod u=rwx,g=rx+s,o=rx /dind-home
-                  chown 1000:1000 /dind-home
-                ||| % { dock_sock: dind_sock },
-              ],
-              securityContext: { runAsUser: 0 },
-              volumeMounts: [
-                {
-                  name: 'dind-etc',
-                  mountPath: '/dind-etc',
-                },
-                {
-                  name: 'dind-home',
-                  mountPath: '/dind-home',
-                },
-              ],
-            },
             {
               name: 'docker',
               image: 'docker:28.0.1-dind-rootless',
@@ -263,7 +247,7 @@ local all = {
                 },
                 {
                   name: 'dind-home',
-                  mountPath: '/home/runner',
+                  mountPath: '/home/rootless',
                 },
               ],
             },
@@ -285,6 +269,12 @@ local all = {
                 name: 'runner-data',
                 mountPath: '/data',
               },
+              {
+                name: 'runner-config',
+                mountPath: '/data/config.yaml',
+                subPath: 'config.yaml',
+                readOnly: true,
+              },
             ],
           }],
         },