daniel/furtka
1
1
Fork 0
Code Issues 1 Pull requests Projects 1 Releases 13 Packages Wiki Activity Actions

ci: switch build-iso to docker-outside-of-docker
Some checks failed
Build ISO / build-iso (push) Failing after 46s
Details
CI / lint (push) Successful in 25s
Details
CI / test (push) Successful in 32s
Details
CI / validate-json (push) Successful in 24s
Details
CI / markdown-links (push) Successful in 14s
Details

Browse source 
The DinD setup was the wrong tool here: forgejo-runner runs on host
docker, but it spawned jobs via the DinD sidecar — meaning jobs
were isolated inside DinD's own docker namespace and couldn't reach
`docker-in-docker` by hostname, and couldn't see the
`forgejo-runner_default` network (which only exists on host docker).

Switched the runner (compose.yml + data/config.yml) to talk directly
to host docker via `/var/run/docker.sock` and added it to the host
`docker` group (GID 988) so the non-root runner user can use the
socket. `valid_volumes` now whitelists the socket so job containers
can mount it too.

Workflow now mounts /var/run/docker.sock into the job container and
points DOCKER_HOST at that unix socket. `./iso/build.sh` then runs
its inner `docker run --privileged archlinux:latest` against the
host daemon — no nested docker.

Tradeoff: this is less isolated than DinD (jobs have full host docker
access — they could spawn arbitrary containers), but on a dedicated
single-user build VM the DooD simplification is worth it.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Daniel Maksymilian Syrnicki 2026-04-14 18:45:32 +02:00
parent 4c5a00a0e0
commit 0f0308bf68
1 changed files with 9 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
.forgejo/workflows/build-iso.yml
View file

@ -16,14 +16,16 @@ jobs:
build-iso: build-iso:
runs-on: ubuntu-latest runs-on: ubuntu-latest
timeout-minutes: 30 timeout-minutes: 30
# DOCKER_HOST points the docker CLI at the DinD sidecar. The sidecar's # The runner is configured for docker-outside-of-docker: it mounts the
# hostname is DNS-resolvable because forgejo-runner is configured with # host's /var/run/docker.sock. Jobs get the same socket so the
# `container.network: "forgejo-runner_default"`, which attaches every # `docker run` inside build.sh talks to the host daemon directly,
# job container to the shared network where docker-in-docker lives. # no DinD gymnastics.
# The default `ubuntu-latest` image (catthehacker/ubuntu:act-latest) container:
# already ships the docker CLI. image: catthehacker/ubuntu:act-latest
volumes:
- /var/run/docker.sock:/var/run/docker.sock
env: env:
DOCKER_HOST: tcp://docker-in-docker:2375 DOCKER_HOST: unix:///var/run/docker.sock
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4