GRM-157: fix: pin Docker 28.x + disable containerd snapshotter + tune prune/disk

Co-authored-by: kireto <kireto@oblachno.com>

ansible/roles/gitea_runner/defaults/main.yml

@@ -18,7 +18,11 @@ gitea_runner_binary_path: "/usr/local/bin/gitea_runner"
 
 # Prune configuration
 gitea_runner_prune_until: "24h"
-gitea_runner_prune_schedule: "daily"
+# Every 6 hours — daily is insufficient for CI runners that build dozens
+# of images per day. Accumulation between daily runs can trigger Docker
+# daemon instability (containerd snapshotter GC holds locks, blocking
+# container operations).
+gitea_runner_prune_schedule: "*-* * */6:00:00"
 gitea_runner_prune_label: "gitea-runner=true"
 
 # Service configuration
@@ -30,7 +34,7 @@ gitea_runner_service_restart_sec: "5"
 # jobs in the window between healthcheck runs.
 gitea_runner_healthcheck_interval: "2min"
 gitea_runner_healthcheck_boot_delay: "2min"
-gitea_runner_healthcheck_disk_threshold: 85
+gitea_runner_healthcheck_disk_threshold: 75
 gitea_runner_healthcheck_script_path: "{{ gitea_runner_config_dir }}/healthcheck.sh"
 
 # Docker daemon resilience settings (applied to daemon.json).

ansible/roles/gitea_runner/tasks/rootless_docker.yml

@@ -31,6 +31,22 @@
     - ansible_facts['os_family'] == 'Debian'
     - gitea_runner_docker_apt_repo is changed
 
+# Pin Docker to 28.x — Docker 29 enables the containerd image store
+# (containerd snapshotter) by default, which has critical instability
+# issues with rootless Docker: "context deadline exceeded" when starting
+# dockerd with many images, snapshot GC holding locks for 30+ seconds
+# blocking container operations, and broken rootless overlayfs on
+# kernels < 5.11. See moby/moby issues #48569, #11021, #53029.
+- name: Pin Docker to 28.x to avoid containerd snapshotter instability (Debian/Ubuntu)
+  ansible.builtin.copy:
+    dest: /etc/apt/preferences.d/docker-pin
+    content: |
+      Package: docker-ce docker-ce-cli docker-ce-rootless-extras containerd.io
+      Pin: version 5:28.*
+      Pin-Priority: 1000
+    mode: "0644"
+  when: ansible_facts['os_family'] == 'Debian'
+
 - name: Install rootless Docker dependencies (Debian/Ubuntu)
   ansible.builtin.apt:
     name:
@@ -221,6 +237,9 @@
         "default-ulimits": {
           "nofile": {"Name": "nofile", "Hard": {{ gitea_runner_docker_default_nofile }}, "Soft": {{ gitea_runner_docker_default_nofile }}}
         },
+        "features": {
+          "containerd-snapshotter": false
+        },
         {% if gitea_runner_docker_rootless_net_driver == 'pasta' %}
         "ipv6": true,
         "ip6tables": true,