Daniel Maksymilian Syrnicki 0f0308bf68 ci: switch build-iso to docker-outside-of-docker ... The DinD setup was the wrong tool here: forgejo-runner runs on host docker, but it spawned jobs via the DinD sidecar — meaning jobs were isolated inside DinD's own docker namespace and couldn't reach `docker-in-docker` by hostname, and couldn't see the `forgejo-runner_default` network (which only exists on host docker). Switched the runner (compose.yml + data/config.yml) to talk directly to host docker via `/var/run/docker.sock` and added it to the host `docker` group (GID 988) so the non-root runner user can use the socket. `valid_volumes` now whitelists the socket so job containers can mount it too. Workflow now mounts /var/run/docker.sock into the job container and points DOCKER_HOST at that unix socket. `./iso/build.sh` then runs its inner `docker run --privileged archlinux:latest` against the host daemon — no nested docker. Tradeoff: this is less isolated than DinD (jobs have full host docker access — they could spawn arbitrary containers), but on a dedicated single-user build VM the DooD simplification is worth it. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>		2026-04-14 18:45:32 +02:00
..
build-iso.yml	ci: switch build-iso to docker-outside-of-docker	2026-04-14 18:45:32 +02:00
ci.yml	ci: attach build-iso job to DinD network, pin lychee-action source	2026-04-14 18:37:54 +02:00