From bdb6521d2a5abb854b1a9926bc167e9d42a2cce8 Mon Sep 17 00:00:00 2001
From: Emil Simeonov <emil@theliberatededge.org>
Date: Thu, 6 Aug 2026 01:34:46 +0200
Subject: [PATCH] fix(ansible): remove Docker 28.x pin/downgrade in
 gitea_runner

Docker 28.x packages are not available for recent Ubuntu releases
(e.g. 26.04/plucky) in the official Docker APT repo. Keep installing
the latest Docker and rely on daemon.json to disable the containerd
snapshotter and set a conservative nofile ulimit for rootless mode.

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 .../gitea_runner/tasks/rootless_docker.yml    | 53 ++-----------------
 1 file changed, 5 insertions(+), 48 deletions(-)

diff --git a/ansible/roles/gitea_runner/tasks/rootless_docker.yml b/ansible/roles/gitea_runner/tasks/rootless_docker.yml
index d70ea0a..8f087dc 100644
--- a/ansible/roles/gitea_runner/tasks/rootless_docker.yml
+++ b/ansible/roles/gitea_runner/tasks/rootless_docker.yml
@@ -31,34 +31,11 @@
     - ansible_facts['os_family'] == 'Debian'
     - gitea_runner_docker_apt_repo is changed
 
-# Pin Docker to 28.x — Docker 29 enables the containerd image store
-# (containerd snapshotter) by default, which has critical instability
-# issues with rootless Docker: "context deadline exceeded" when starting
-# dockerd with many images, snapshot GC holding locks for 30+ seconds
-# blocking container operations, and broken rootless overlayfs on
-# kernels < 5.11. See moby/moby issues #48569, #11021, #53029.
-- name: Pin Docker to 28.x to avoid containerd snapshotter instability (Debian/Ubuntu)
-  ansible.builtin.copy:
-    dest: /etc/apt/preferences.d/docker-pin
-    content: |
-      Package: docker-ce docker-ce-cli docker-ce-rootless-extras containerd.io
-      Pin: version 5:28.*
-      Pin-Priority: 1000
-    mode: "0644"
-  register: gitea_runner_docker_pin
-  when: ansible_facts['os_family'] == 'Debian'
-
-- name: Update apt cache after pinning Docker (Debian/Ubuntu)
-  ansible.builtin.apt:
-    update_cache: true
-  when:
-    - ansible_facts['os_family'] == 'Debian'
-    - gitea_runner_docker_pin is changed
-
-# Install Docker packages. The APT pin (priority 1000) makes 28.x the
-# candidate, so state: present installs 28.x on fresh systems. On systems
-# where Docker 29 was previously installed, a separate downgrade task
-# handles the version pin.
+# Install Docker packages from the upstream Docker APT repository.
+# We do NOT pin to 28.x because recent Ubuntu releases (e.g. 26.04/plucky)
+# may not have 28.x packages in the Docker repo, and Docker 29 is safe
+# for rootless mode when the daemon.json disables the containerd snapshotter
+# and sets a conservative default nofile ulimit (see daemon.json tasks below).
 - name: Install rootless Docker dependencies (Debian/Ubuntu)
   ansible.builtin.apt:
     name:
@@ -76,26 +53,6 @@
   register: gitea_runner_docker_install
   when: ansible_facts['os_family'] == 'Debian'
 
-# Downgrade Docker 29 → 28 if needed. state: present won't downgrade,
-# so we check the installed version and force-install the pinned version.
-- name: Check installed Docker version (Debian/Ubuntu)
-  ansible.builtin.command: dpkg-query -W -f='${Version}' docker-ce
-  changed_when: false
-  register: gitea_runner_installed_docker_version
-  when: ansible_facts['os_family'] == 'Debian'
-
-- name: Downgrade Docker to 28.x if 29.x is installed (Debian/Ubuntu)
-  ansible.builtin.apt:
-    name:
-      - docker-ce=5:28.*
-      - docker-ce-cli=5:28.*
-      - docker-ce-rootless-extras=5:28.*
-    state: present
-    allow_downgrades: true
-  when:
-    - ansible_facts['os_family'] == 'Debian'
-    - "'29.' in gitea_runner_installed_docker_version.stdout"
-
 - name: Update pacman cache (Arch Linux)
   community.general.pacman:
     update_cache: true