diff --git a/ansible/roles/gitea_runner/defaults/main.yml b/ansible/roles/gitea_runner/defaults/main.yml
index 5a5fe71..1d991ce 100644
--- a/ansible/roles/gitea_runner/defaults/main.yml
+++ b/ansible/roles/gitea_runner/defaults/main.yml
@@ -76,6 +76,14 @@ gitea_runner_docker_shutdown_timeout: 30
 gitea_runner_docker_max_concurrent_downloads: 3
 gitea_runner_docker_max_concurrent_uploads: 3
 gitea_runner_docker_default_nofile: 65536
+# Log file size limits — under parallel DinD load, container logs can fill
+# disk and cause the daemon to become unresponsive. Limit log size per container.
+gitea_runner_docker_max_log_size: "10m"
+gitea_runner_docker_max_log_files: 3
+# Userland proxy disabled — it adds overhead and can become a bottleneck
+# under parallel container creation. Direct routing is faster and more
+# reliable for CI workloads.
+gitea_runner_docker_userland_proxy: false
 
 # Admin token for runner deregistration via Gitea API.
 # If not set, falls back to registration_token (which likely lacks admin scope).
diff --git a/ansible/roles/gitea_runner/tasks/rootless_docker.yml b/ansible/roles/gitea_runner/tasks/rootless_docker.yml
index 8f087dc..20c8496 100644
--- a/ansible/roles/gitea_runner/tasks/rootless_docker.yml
+++ b/ansible/roles/gitea_runner/tasks/rootless_docker.yml
@@ -180,6 +180,11 @@
         "features": {
           "containerd-snapshotter": false
         },
+        "userland-proxy": {{ gitea_runner_docker_userland_proxy | to_json }},
+        "log-opts": {
+          "max-size": "{{ gitea_runner_docker_max_log_size }}",
+          "max-file": {{ gitea_runner_docker_max_log_files }}
+        },
         {% if gitea_runner_docker_rootless_net_driver == 'pasta' %}
         "ipv6": true,
         "ip6tables": true,
@@ -283,6 +288,11 @@
         "features": {
           "containerd-snapshotter": false
         },
+        "userland-proxy": {{ gitea_runner_docker_userland_proxy | to_json }},
+        "log-opts": {
+          "max-size": "{{ gitea_runner_docker_max_log_size }}",
+          "max-file": {{ gitea_runner_docker_max_log_files }}
+        },
         {% if gitea_runner_docker_rootless_net_driver == 'pasta' %}
         "ipv6": true,
         "ip6tables": true,