panxiao81/homelab-infra
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): use compatible DinD runner #3

Merged
panxiao81 merged 1 commits from fix/gitea-runner-dind into main 2026-09-09 17:49:29 +00:00
Conversation 0 Commits 1 Files Changed 4
+22 -18
panxiao81 commented 2026-09-09 17:49:00 +00:00
Owner
Copy Link
Copy Source

Summary

  • switch the Gitea Actions sidecar from rootless DinD to regular DinD
  • keep AppArmor's host-wide unprivileged-userns restriction enabled
  • document that the runner uses an instance-scoped registration token
  • record the failed bootstrap finding in the changelog

Why

The official chart marks DinD privileged in both modes. On this Ubuntu node, rootlesskit is still rejected by kernel.apparmor_restrict_unprivileged_userns, so rootless mode does not start unless the host-wide policy is weakened.

Validation

  • yamllint
  • helm lint against actions 0.1.1
  • helm template piped to kubectl apply --dry-run=client
  • rendered image and socket paths inspected
  • git diff --check
  • no Terraform state or plan files in the diff

Deployment

The initial release is currently pending with the old rootless DinD init container in CrashLoopBackOff. After merge, rerun helm upgrade with the reviewed values and verify runner registration plus the queued workflow.

## Summary - switch the Gitea Actions sidecar from rootless DinD to regular DinD - keep AppArmor's host-wide unprivileged-userns restriction enabled - document that the runner uses an instance-scoped registration token - record the failed bootstrap finding in the changelog ## Why The official chart marks DinD privileged in both modes. On this Ubuntu node, rootlesskit is still rejected by kernel.apparmor_restrict_unprivileged_userns, so rootless mode does not start unless the host-wide policy is weakened. ## Validation - yamllint - helm lint against actions 0.1.1 - helm template piped to kubectl apply --dry-run=client - rendered image and socket paths inspected - git diff --check - no Terraform state or plan files in the diff ## Deployment The initial release is currently pending with the old rootless DinD init container in CrashLoopBackOff. After merge, rerun helm upgrade with the reviewed values and verify runner registration plus the queued workflow.
panxiao81 added 1 commit 2026-09-09 17:49:01 +00:00
fix(ci): use compatible DinD runner
lint / terraform (push) Failing after 2s
Details
lint / yaml (push) Failing after 52s
Details
lint / terraform (pull_request) Failing after 2s
Details
lint / yaml (pull_request) Failing after 52s
Details
lint / ansible (push) Failing after 1m42s
Details
lint / ansible (pull_request) Failing after 1m43s
Details
e513739ba0
panxiao81 merged commit 0644c25567 into main 2026-09-09 17:49:29 +00:00
panxiao81 deleted branch fix/gitea-runner-dind 2026-09-09 17:49:29 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
panxiao81 (Xiao Pan)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: panxiao81/homelab-infra#3