services:
  # Isolated Docker daemon for the runner's job containers.
  # Keeps the host Docker clean and gives reliable cache networking.
  dind:
    image: docker:29-dind
    container_name: gitea-runner-dind
    privileged: true
    restart: unless-stopped
    # The third --host exposes the daemon over a unix socket on a volume shared
    # with the runner (dind-sock), *in addition to* its own /var/run/docker.sock.
    # act_runner's job-container DooD wiring only understands unix:// (or bare)
    # socket paths -- it bind-mounts that path from ITS OWN filesystem into every
    # job container as /var/run/docker.sock, it does not pass DOCKER_HOST through
    # as an env var. A bare "tcp://..." isn't recognized and silently falls back
    # to /var/run/docker.sock, which doesn't exist in the runner container -- so
    # this shared socket is what makes `docker build` etc. work inside jobs.
    command: ["dockerd", "--host=tcp://0.0.0.0:2375", "--host=unix:///var/run/docker.sock", "--host=unix:///dind-sock/docker.sock", "--tls=false"]
    environment:
      DOCKER_TLS_CERTDIR: ""
    networks:
      - runner
    volumes:
      # Persist pulled job images + docker layer cache => fast Rust rebuilds.
      - dind-storage:/var/lib/docker
      # Shared with the runner container; see the --host comment above.
      - dind-sock:/dind-sock
    healthcheck:
      test: ["CMD", "docker", "info"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 10s

  runner:
    # Ghim theo digest, KHÔNG dùng :nightly. Tag tự cập nhật + cache nằm trong
    # writable layer = một lệnh 'compose pull' là mất sạch cache.
    # Nâng cấp có chủ đích: đổi digest ở đây rồi commit.
    image: docker.io/gitea/act_runner@sha256:7940221bcfc9df16f3401ddafb2231bf98bba5517bc381224c7a2c504b558974
    container_name: gitea-runner-wsl
    restart: unless-stopped
    depends_on:
      dind:
        condition: service_healthy
    networks:
      - runner
    environment:
      GITEA_INSTANCE_URL: ${GITEA_INSTANCE_URL}
      GITEA_RUNNER_REGISTRATION_TOKEN: ${GITEA_RUNNER_REGISTRATION_TOKEN}
      GITEA_RUNNER_NAME: ${GITEA_RUNNER_NAME}
      GITEA_RUNNER_LABELS: ""
      # Point the runner at the DinD daemon. Overridden at startup by act_runner
      # itself to config.yaml's container.docker_host (the unix socket below),
      # since our labels require docker; kept here as a documented fallback.
      DOCKER_HOST: tcp://dind:2375
      CONFIG_FILE: /config.yaml
    volumes:
      - ./config.yaml:/config.yaml:ro
      # Persist runner registration so it survives restarts.
      - runner-data:/data
      # Shared with dind; see the --host comment on the dind service.
      - dind-sock:/dind-sock
      # Cache của actions/cache. Mặc định act_runner ghi vào
      # $HOME/.cache/actcache = WRITABLE LAYER của container -> mất sạch mỗi
      # lần container bị tạo lại. Phải khớp với cache.dir trong config.yaml.
      - runner-cache:/cache

networks:
  runner:

volumes:
  dind-storage:
  runner-data:
  dind-sock:
  runner-cache: