.gitea/workflows/pod-smoke.yml

@@ -1,5 +1,7 @@
+---
 name: dynamic Pod smoke test
 
+# yamllint disable-line rule:truthy
 on:
   workflow_dispatch:
 
@@ -17,3 +19,41 @@ jobs:
             -socketPath /run/spire/agent-sockets/spire-agent.sock \
             >/dev/null
           test "$(id -u)" = 2000
+
+      - name: Start job-local Docker
+        shell: bash
+        run: |
+          set -euo pipefail
+          findmnt /var/lib/docker
+          sudo nohup dockerd \
+            --host=unix:///var/run/docker.sock \
+            --storage-driver=overlay2 \
+            >/tmp/dockerd.log 2>&1 &
+          for _ in {1..60}; do
+            if docker info >/dev/null 2>&1; then
+              exit 0
+            fi
+            sleep 1
+          done
+          cat /tmp/dockerd.log
+          exit 1
+
+      - name: Build and run image
+        shell: bash
+        run: |
+          set -euo pipefail
+          context=$(mktemp -d)
+          cleanup() {
+            docker image rm --force pod-docker-smoke:test \
+              >/dev/null 2>&1 || true
+            rm -rf -- "$context"
+          }
+          trap cleanup EXIT
+          printf '%s\n' \
+            'FROM alpine:3.22' \
+            'RUN printf pod-docker-ok >/result' \
+            >"$context/Dockerfile"
+          docker build --tag pod-docker-smoke:test "$context"
+          output=$(docker run --rm pod-docker-smoke:test cat /result)
+          test "$output" = pod-docker-ok
+          test "$(docker info --format '{{.Driver}}')" = overlay2

internal/podbackend/client.go

@@ -8,6 +8,7 @@ import (
 
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime/schema"
@@ -76,16 +77,25 @@ func (c *Client) CreatePod(ctx context.Context, manifest PodManifest) (Pod, erro
 			Containers: []corev1.Container{{
 				Name: "executor", Image: manifest.Image, Args: manifest.Args, Env: environment,
 				SecurityContext: &corev1.SecurityContext{Privileged: boolPointer(true)},
-				VolumeMounts: []corev1.VolumeMount{{
-					Name: "spire-agent-socket", MountPath: "/run/spire/agent-sockets", ReadOnly: true,
-				}},
-			}},
-			Volumes: []corev1.Volume{{
-				Name: "spire-agent-socket",
-				VolumeSource: corev1.VolumeSource{CSI: &corev1.CSIVolumeSource{
-					Driver: "csi.spiffe.io", ReadOnly: boolPointer(true),
-				}},
+				VolumeMounts: []corev1.VolumeMount{
+					{Name: "spire-agent-socket", MountPath: "/run/spire/agent-sockets", ReadOnly: true},
+					{Name: "docker-data", MountPath: "/var/lib/docker"},
+				},
 			}},
+			Volumes: []corev1.Volume{
+				{
+					Name: "spire-agent-socket",
+					VolumeSource: corev1.VolumeSource{CSI: &corev1.CSIVolumeSource{
+						Driver: "csi.spiffe.io", ReadOnly: boolPointer(true),
+					}},
+				},
+				{
+					Name: "docker-data",
+					VolumeSource: corev1.VolumeSource{EmptyDir: &corev1.EmptyDirVolumeSource{
+						SizeLimit: resourceQuantity("20Gi"),
+					}},
+				},
+			},
 		},
 	}
 	created, err := c.Kubernetes.CoreV1().Pods(manifest.Namespace).Create(ctx, document, metav1.CreateOptions{})
@@ -169,6 +179,11 @@ func podFromKubernetes(pod corev1.Pod) Pod {
 
 func boolPointer(value bool) *bool { return &value }
 
+func resourceQuantity(value string) *resource.Quantity {
+	quantity := resource.MustParse(value)
+	return &quantity
+}
+
 func stringMap(values map[string]string) map[string]any {
 	result := make(map[string]any, len(values))
 	for key, value := range values {

internal/podbackend/client_test.go

@@ -37,6 +37,12 @@ func TestClientPodLifecycleUsesTypedClient(t *testing.T) {
 	if got := pod.Spec.Containers[0].Env; len(got) != 1 || got[0].Name != "CI_RUNNER_CAPABILITY" || got[0].Value != "capability" {
 		t.Fatalf("environment = %#v", got)
 	}
+	if got := pod.Spec.Containers[0].VolumeMounts; len(got) != 2 || got[1].Name != "docker-data" || got[1].MountPath != "/var/lib/docker" {
+		t.Fatalf("volume mounts = %#v", got)
+	}
+	if got := pod.Spec.Volumes; len(got) != 2 || got[1].EmptyDir == nil || got[1].EmptyDir.SizeLimit == nil || got[1].EmptyDir.SizeLimit.String() != "20Gi" {
+		t.Fatalf("volumes = %#v", got)
+	}
 	if err := client.LabelPod(context.Background(), "gitea-actions", created.Name, map[string]string{terminalLabel: "true"}); err != nil {
 		t.Fatal(err)
 	}