GRM-157: fix: pin Docker 28.x + disable containerd snapshotter + tune prune/disk

Co-authored-by: kireto <kireto@oblachno.com>

ansible/roles/gitea_runner/tasks/rootless_docker.yml

@@ -31,6 +31,22 @@
     - ansible_facts['os_family'] == 'Debian'
     - gitea_runner_docker_apt_repo is changed
 
+# Pin Docker to 28.x — Docker 29 enables the containerd image store
+# (containerd snapshotter) by default, which has critical instability
+# issues with rootless Docker: "context deadline exceeded" when starting
+# dockerd with many images, snapshot GC holding locks for 30+ seconds
+# blocking container operations, and broken rootless overlayfs on
+# kernels < 5.11. See moby/moby issues #48569, #11021, #53029.
+- name: Pin Docker to 28.x to avoid containerd snapshotter instability (Debian/Ubuntu)
+  ansible.builtin.copy:
+    dest: /etc/apt/preferences.d/docker-pin
+    content: |
+      Package: docker-ce docker-ce-cli docker-ce-rootless-extras containerd.io
+      Pin: version 5:28.*
+      Pin-Priority: 1000
+    mode: "0644"
+  when: ansible_facts['os_family'] == 'Debian'
+
 - name: Install rootless Docker dependencies (Debian/Ubuntu)
   ansible.builtin.apt:
     name:
@@ -221,6 +237,9 @@
         "default-ulimits": {
           "nofile": {"Name": "nofile", "Hard": {{ gitea_runner_docker_default_nofile }}, "Soft": {{ gitea_runner_docker_default_nofile }}}
         },
+        "features": {
+          "containerd-snapshotter": false
+        },
         {% if gitea_runner_docker_rootless_net_driver == 'pasta' %}
         "ipv6": true,
         "ip6tables": true,