forgejo: runner rootless dind (v4)

Author: jaredallard

manifests/apps/by-cluster/rgst/forgejo.jsonnet

@@ -144,13 +144,13 @@ local all = {
         runner: {
           // Generated by the registration init container.
           file: '.runner',
+          envs: {
+            DOCKER_HOST: 'tcp://localhost:2376',
+          },
           capacity: 2,
         },
         container: {
-          valid_volumes: ['**'],
           force_pull: true,  // TODO(jaredallard): Periodic re-pull?
-          // Expose our socket into the container.
-          options: '-v /run/docker/docker.sock:/var/run/docker.sock:ro',
         },
       }),
     },
@@ -172,108 +172,88 @@ local all = {
             'kubernetes.io/hostname': 'mocha',
           },
           volumes: [
+            { name: 'dind-home', emptyDir: {} },
+            { name: 'runner-data', emptyDir: {} },
             {
-              name: name,
-              emptyDir: {},
-            }
-            for name in ['dind-sock', 'dind-home', 'runner-data']
-          ] + [{
-            name: 'runner-config',
-            configMap: {
-              name: all.runner_config.metadata.name,
+              name: 'runner-config',
+              configMap: {
+                name: all.runner_config.metadata.name,
+              },
             },
+          ],
+          initContainers: [{
+            name: 'runner-register',
+            image: 'code.forgejo.org/forgejo/runner:6.2.2',
+            command: [
+              'forgejo-runner',
+              'register',
+              '--no-interactive',
+              '--token',
+              '$(RUNNER_SECRET)',
+              '--name',
+              '$(RUNNER_NAME)',
+              '--instance',
+              '$(FORGEJO_INSTANCE_URL)',
+              '--labels',
+              'ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest',
+            ],
+            env: k.envList({
+              RUNNER_NAME: { fieldRef: { fieldPath: 'metadata.name' } },
+              RUNNER_SECRET: { secretKeyRef: { name: $.external_secret.metadata.name, key: 'RUNNER_SECRET' } },
+              FORGEJO_INSTANCE_URL: 'http://forgejo-http.forgejo.svc.cluster.local:3000',
+            }),
+            volumeMounts: [{
+              name: 'runner-data',
+              mountPath: '/data',
+            }],
           }],
-          local dind_sock_dir = '/run/docker',
-          local dind_sock = dind_sock_dir + '/docker.sock',
-          initContainers: [
+          containers: [
             {
-              name: 'runner-register',
+              name: 'runner',
               image: 'code.forgejo.org/forgejo/runner:6.2.2',
-              command: [
-                'forgejo-runner',
-                'register',
-                '--no-interactive',
-                '--token',
-                '$(RUNNER_SECRET)',
-                '--name',
-                '$(RUNNER_NAME)',
-                '--instance',
-                '$(FORGEJO_INSTANCE_URL)',
-                '--labels',
-                'ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest',
+              command: ['sh', '-e', '-c'],
+              args: [
+                |||
+                  while ! nc -z localhost 2376 </dev/null; do
+                    echo 'waiting for docker daemon...' >&2
+                    sleep 2
+                  done
+
+                  exec forgejo-runner daemon
+                |||,
               ],
               env: k.envList({
-                RUNNER_NAME: { fieldRef: { fieldPath: 'metadata.name' } },
-                RUNNER_SECRET: { secretKeyRef: { name: $.external_secret.metadata.name, key: 'RUNNER_SECRET' } },
-                FORGEJO_INSTANCE_URL: 'http://forgejo-http.forgejo.svc.cluster.local:3000',
+                DOCKER_HOST: 'tcp://localhost:2376',
               }),
-              resources: {
-                limits: {
-                  cpu: 6,
-                  memory: '12Gi',
+              volumeMounts: [
+                {
+                  name: 'runner-data',
+                  mountPath: '/data',
                 },
-                requests: {
-                  cpu: 2,
-                  memory: '4Gi',
+                {
+                  name: 'runner-config',
+                  mountPath: '/data/config.yaml',
+                  subPath: 'config.yaml',
+                  readOnly: true,
                 },
-              },
-              volumeMounts: [{
-                name: 'runner-data',
-                mountPath: '/data',
-              }],
+              ],
             },
             {
               name: 'docker',
               image: 'docker:28.0.1-dind-rootless',
-              args: [
-                '--host',
-                'unix://' + dind_sock,
-              ],
               securityContext: {
                 seccompProfile: { type: 'Unconfined' },
                 appArmorProfile: { type: 'Unconfined' },
                 privileged: true,
                 runAsUser: 1000,
                 runAsGroup: 1000,
               },
-              restartPolicy: 'Always',  // sidecar
-              volumeMounts: [
-                {
-                  name: 'dind-sock',
-                  mountPath: dind_sock_dir,
-                },
-                {
-                  name: 'dind-home',
-                  mountPath: '/home/rootless',
-                },
-              ],
+              volumeMounts: [{
+                name: 'dind-home',
+                mountPath: '/home/rootless',
+              }],
             },
           ],
-          containers: [{
-            name: 'runner',
-            image: 'code.forgejo.org/forgejo/runner:6.2.2',
-            command: ['forgejo-runner', 'daemon'],
-            env: k.envList({
-              DOCKER_HOST: 'unix:///run/docker/docker.sock',
-            }),
-            volumeMounts: [
-              {
-                name: 'dind-sock',
-                mountPath: dind_sock_dir,
-                readOnly: true,
-              },
-              {
-                name: 'runner-data',
-                mountPath: '/data',
-              },
-              {
-                name: 'runner-config',
-                mountPath: '/data/config.yaml',
-                subPath: 'config.yaml',
-                readOnly: true,
-              },
-            ],
-          }],
         },
       },
     },