initial commit

2026-10-03 16:09:47 +02:00
commit b5224cb512
25 changed files with 1804 additions and 0 deletions
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Replaces the image's own /etc/s6/act_runner/run. Two waits, both of which the
+# stock script gets wrong for this deployment.
+#
+# 1. The nested Docker daemon. Upstream waits for it through s6's readiness
+#    notification. On a cold start with a warm image store dockerd takes longer
+#    than s6-notifyoncheck's window, the notification never arrives, s6 marks
+#    the service permanently failed, and act_runner sits blocked in
+#    `s6-svwait -U` for two to four minutes before s6 gives up and lets it past
+#    anyway. The runner shows "offline" in the forge for that whole time and
+#    picks up no jobs. Asking the daemon directly is the same wait without the
+#    guesswork.
+#
+# 2. The registration token. It is minted by an init step that runs after the
+#    stack is up, so on a first install it does not exist yet when this
+#    container starts — and the stock entrypoint reads the token file exactly
+#    once, before its retry loop, so a token that arrives late is never seen.
+
+while [ ! -d /etc/s6/docker/supervise ]; do
+    sleep 0.1
+done
+
+while ! docker info >/dev/null 2>&1; do
+    sleep 1
+done
+
+while [ ! -s "${GITEA_RUNNER_REGISTRATION_TOKEN_FILE:-/data/token}" ] && [ ! -s /data/.runner ]; do
+    echo "waiting for the runner registration token"
+    sleep 2
+done
+
+exec run.sh
@@ -0,0 +1,40 @@
+# act_runner configuration. Only the settings that differ from upstream's
+# defaults are written out — `act_runner generate-config` prints the full set.
+
+log:
+  level: info
+
+runner:
+  # The file the runner's own registration is kept in, relative to /data.
+  file: .runner
+  # One job at a time. A PCS shares its CPU with everything else installed on
+  # it, and an image build is the least polite thing on the box.
+  capacity: 1
+  timeout: 1h
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  # Overrides the labels stored at registration (.runner). These are upstream
+  # act_runner defaults: Gitea's own job images, which carry node, bash, git
+  # and the docker CLI with buildx, so marketplace actions (actions/checkout,
+  # docker/build-push-action, ...) run as they do on GitHub. The registration
+  # labels pointed at node:22-bookworm, which has no docker CLI.
+  labels:
+    - "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+    - "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
+    - "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
+    - "docker:docker://docker:28.5-cli"
+
+cache:
+  # The cache server binds an address inside the runner container, which the
+  # job containers — created by the Docker daemon nested inside that same
+  # container — cannot route to. Left on, every `actions/cache` step fails
+  # noisily instead of being skipped.
+  enabled: false
+
+container:
+  # Jobs run on the runner's own nested daemon, on its default bridge: they
+  # reach the internet, and they reach Gitea the way anything outside would,
+  # through its public address.
+  network: bridge
+  privileged: false
+  force_pull: false