fix(runner): fully detach job Docker daemon

.gitea/workflows/publish-images.yml

@@ -15,7 +15,7 @@ on:
   workflow_dispatch:
 
 jobs:
-  publish-controller:
+  publish-images:
     name: publish-controller
     runs-on: [self-hosted, vm]
     timeout-minutes: 45

.gitea/workflows/publish-runner-image.yml

@@ -5,7 +5,7 @@ on:
   workflow_dispatch:
 
 jobs:
-  publish-runner:
+  publish-images:
     name: publish-runner
     runs-on: [self-hosted, vm]
     timeout-minutes: 45

internal/runnerbootstrap/executor.go

@@ -22,6 +22,7 @@ type ExecutorConfig struct {
 	FacadeSPIFFEID  string
 	WorkloadAPIAddr string
 	RunnerBinary    string
+	RunnerConfig    string
 	ListenAddress   string
 	WorkDir         string
 	Stdout          *os.File
@@ -35,6 +36,9 @@ func RunExecutor(ctx context.Context, config ExecutorConfig) error {
 	if config.RunnerBinary == "" {
 		config.RunnerBinary = "gitea-runner"
 	}
+	if config.RunnerConfig == "" {
+		config.RunnerConfig = "/etc/gitea-runner/config.yaml"
+	}
 	if config.ListenAddress == "" {
 		config.ListenAddress = "127.0.0.1:0"
 	}
@@ -93,7 +97,7 @@ func RunExecutor(ctx context.Context, config ExecutorConfig) error {
 		return errors.Join(readyErr, shutdownErr, serverErr)
 	}
 
-	command := exec.CommandContext(ctx, config.RunnerBinary, "daemon", "--once")
+	command := exec.CommandContext(ctx, config.RunnerBinary, runnerArguments(config.RunnerConfig)...)
 	command.Dir = workDir
 	command.Stdout = config.Stdout
 	command.Stderr = config.Stderr
@@ -108,6 +112,10 @@ func RunExecutor(ctx context.Context, config ExecutorConfig) error {
 	return errors.Join(runnerErr, shutdownErr, serverErr)
 }
 
+func runnerArguments(configFile string) []string {
+	return []string{"daemon", "--config", configFile, "--once"}
+}
+
 func waitForFacade(ctx context.Context, endpoint string) error {
 	client := &http.Client{Timeout: 2 * time.Second}
 	ticker := time.NewTicker(250 * time.Millisecond)
@@ -143,8 +151,9 @@ func ExecutorConfigFromEnvironment() (ExecutorConfig, error) {
 	config := ExecutorConfig{
 		AssignmentID: os.Getenv(EnvAssignmentID), Capability: os.Getenv(EnvCapability),
 		Backend: backend, FacadeURL: os.Getenv(EnvFacadeURL), FacadeSPIFFEID: os.Getenv(EnvFacadeID),
-		RunnerBinary: os.Getenv("GITEA_RUNNER_BINARY"), ListenAddress: "127.0.0.1:0",
-		Stdout: os.Stdout, Stderr: os.Stderr,
+		RunnerBinary: os.Getenv("GITEA_RUNNER_BINARY"), RunnerConfig: os.Getenv("GITEA_RUNNER_CONFIG_FILE"),
+		ListenAddress: "127.0.0.1:0",
+		Stdout:        os.Stdout, Stderr: os.Stderr,
 	}
 	if config.AssignmentID == "" || config.Capability == "" || config.FacadeURL == "" || config.FacadeSPIFFEID == "" {
 		return ExecutorConfig{}, errors.New("complete runner assignment and facade environment is required")

internal/runnerbootstrap/executor_test.go

@@ -4,11 +4,19 @@ import (
 	"context"
 	"net/http"
 	"net/http/httptest"
+	"reflect"
 	"sync/atomic"
 	"testing"
 	"time"
 )
 
+func TestRunnerArgumentsLoadJobHooksConfig(t *testing.T) {
+	want := []string{"daemon", "--config", "/etc/gitea-runner/config.yaml", "--once"}
+	if got := runnerArguments("/etc/gitea-runner/config.yaml"); !reflect.DeepEqual(got, want) {
+		t.Fatalf("runner arguments = %q, want %q", got, want)
+	}
+}
+
 func TestWaitForFacadeRetriesTransientGatewayFailure(t *testing.T) {
 	var requests atomic.Int32
 	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, _ *http.Request) {

scripts/setup-job-docker

@@ -42,9 +42,9 @@ if [[ -f /sys/fs/cgroup/cgroup.controllers ]]; then
   '
 fi
 
-sudo sh -c 'exec nohup dockerd "$@" >/tmp/dockerd.log 2>&1' sh \
+sudo sh -c 'nohup dockerd "$@" </dev/null >/tmp/dockerd.log 2>&1 &' sh \
   --host=unix:///var/run/docker.sock \
-  --storage-driver="$storage_driver" &
+  --storage-driver="$storage_driver"
 printf '%s\n' 'waiting for job Docker daemon'
 for ((attempt = 0; attempt < wait_seconds; attempt++)); do
   if docker info >/dev/null 2>&1; then