nampdn
6f07013db3
The 2026-09-05 rewrite dropped the dns: list, so dockerd inside dind inherited the host's systemd-resolved (Tailscale DNS enabled) through Docker's embedded resolver and got SERVFAIL for every public name -- every job then died pulling the runner image, and Gitea left the jobs orphaned. Restores three settings, each documented inline: dns: for dockerd's own pulls, --dns for the job containers (tailnet resolver first, public second, so MagicDNS names resolve inside a job), and --default-address-pool so a CI run cannot exhaust the fifteen default /16s. Committed this time. The same settings were applied on 2026-09-03 without a commit and were lost to the next rewrite.
101 lines
4.7 KiB
YAML
101 lines
4.7 KiB
YAML
services:
|
|
# Isolated Docker daemon for the runner's job containers.
|
|
# Keeps the host Docker clean and gives reliable cache networking.
|
|
dind:
|
|
image: docker:29-dind
|
|
container_name: gitea-runner-dind
|
|
privileged: true
|
|
restart: unless-stopped
|
|
# The third --host exposes the daemon over a unix socket on a volume shared
|
|
# with the runner (dind-sock), *in addition to* its own /var/run/docker.sock.
|
|
# act_runner's job-container DooD wiring only understands unix:// (or bare)
|
|
# socket paths -- it bind-mounts that path from ITS OWN filesystem into every
|
|
# job container as /var/run/docker.sock, it does not pass DOCKER_HOST through
|
|
# as an env var. A bare "tcp://..." isn't recognized and silently falls back
|
|
# to /var/run/docker.sock, which doesn't exist in the runner container -- so
|
|
# this shared socket is what makes `docker build` etc. work inside jobs.
|
|
# Two DNS settings, for two different resolvers, and both are load-bearing.
|
|
#
|
|
# dns: (below) the dind CONTAINER's resolv.conf, which is what dockerd
|
|
# itself uses to pull images. Without an explicit list it
|
|
# inherits Docker's embedded resolver, which forwards to
|
|
# the host's systemd-resolved; with Tailscale DNS enabled
|
|
# there, public names come back SERVFAIL and every job
|
|
# dies at "docker pull" of the runner image itself. This
|
|
# is what took the runner down on 2026-09-05.
|
|
#
|
|
# --dns (here) what dockerd hands to the JOB containers it creates.
|
|
# The tailnet resolver first, so NOMAD_ADDR and the
|
|
# staging Postgres resolve inside a job (they are
|
|
# MagicDNS names); a public resolver second, because
|
|
# 100.100.100.100 answers only for the tailnet and
|
|
# SERVFAILs everything else -- getaddrinfo falls through.
|
|
#
|
|
# --default-address-pool replaces the daemon default of fifteen /16s in
|
|
# 172.17-172.31, which a CI run exhausts ("all predefined address pools
|
|
# have been fully subnetted"): the host holds three, each lane creates its
|
|
# own network, and a killed job leaves one behind. 10.210/16 in /24s is 256
|
|
# networks and collides with nothing here (no 10.x route on the host; the
|
|
# tailnet is 100.64/10).
|
|
command: ["dockerd", "--host=tcp://0.0.0.0:2375", "--host=unix:///var/run/docker.sock", "--host=unix:///dind-sock/docker.sock", "--tls=false", "--dns=100.100.100.100", "--dns=1.1.1.1", "--default-address-pool", "base=10.210.0.0/16,size=24"]
|
|
environment:
|
|
DOCKER_TLS_CERTDIR: ""
|
|
dns:
|
|
- 1.1.1.1
|
|
- 1.0.0.1
|
|
networks:
|
|
- runner
|
|
volumes:
|
|
# Persist pulled job images + docker layer cache => fast Rust rebuilds.
|
|
- dind-storage:/var/lib/docker
|
|
# Shared with the runner container; see the --host comment above.
|
|
- dind-sock:/dind-sock
|
|
healthcheck:
|
|
test: ["CMD", "docker", "info"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 10
|
|
start_period: 10s
|
|
|
|
runner:
|
|
# Ghim theo digest, KHÔNG dùng :nightly. Tag tự cập nhật + cache nằm trong
|
|
# writable layer = một lệnh 'compose pull' là mất sạch cache.
|
|
# Nâng cấp có chủ đích: đổi digest ở đây rồi commit.
|
|
image: docker.io/gitea/act_runner@sha256:7940221bcfc9df16f3401ddafb2231bf98bba5517bc381224c7a2c504b558974
|
|
container_name: gitea-runner-wsl
|
|
restart: unless-stopped
|
|
depends_on:
|
|
dind:
|
|
condition: service_healthy
|
|
networks:
|
|
- runner
|
|
environment:
|
|
GITEA_INSTANCE_URL: ${GITEA_INSTANCE_URL}
|
|
GITEA_RUNNER_REGISTRATION_TOKEN: ${GITEA_RUNNER_REGISTRATION_TOKEN}
|
|
GITEA_RUNNER_NAME: ${GITEA_RUNNER_NAME}
|
|
GITEA_RUNNER_LABELS: ""
|
|
# Point the runner at the DinD daemon. Overridden at startup by act_runner
|
|
# itself to config.yaml's container.docker_host (the unix socket below),
|
|
# since our labels require docker; kept here as a documented fallback.
|
|
DOCKER_HOST: tcp://dind:2375
|
|
CONFIG_FILE: /config.yaml
|
|
volumes:
|
|
- ./config.yaml:/config.yaml:ro
|
|
# Persist runner registration so it survives restarts.
|
|
- runner-data:/data
|
|
# Shared with dind; see the --host comment on the dind service.
|
|
- dind-sock:/dind-sock
|
|
# Cache của actions/cache. Mặc định act_runner ghi vào
|
|
# $HOME/.cache/actcache = WRITABLE LAYER của container -> mất sạch mỗi
|
|
# lần container bị tạo lại. Phải khớp với cache.dir trong config.yaml.
|
|
- runner-cache:/cache
|
|
|
|
networks:
|
|
runner:
|
|
|
|
volumes:
|
|
dind-storage:
|
|
runner-data:
|
|
dind-sock:
|
|
runner-cache:
|