From da86eb0e9de5f4433823bc2b1e0b94cb97a3dcac Mon Sep 17 00:00:00 2001 From: Emil Simeonov Date: Sat, 20 Jun 2026 22:37:31 +0200 Subject: [PATCH] fix: skip rootless Docker daemon startup in molecule tests Rootless Docker requires newuidmap/newgidmap kernel support which doesn't work in nested Docker containers (Operation not permitted). Added docker_rootless_setup variable (default true) to skip the daemon startup steps. Set to false in all molecule converge playbooks so tests verify package installation, user creation, service file rendering, and config without requiring a working rootless daemon. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- ansible/roles/gitea-runner/defaults/main.yml | 2 ++ ansible/roles/gitea-runner/molecule/default/converge.yml | 1 + .../roles/gitea-runner/molecule/deregister/converge.yml | 1 + ansible/roles/gitea-runner/molecule/lifecycle/converge.yml | 1 + .../gitea-runner/molecule/multi-instance/converge.yml | 2 ++ .../gitea-runner/molecule/template-content/converge.yml | 1 + ansible/roles/gitea-runner/molecule/update/converge.yml | 1 + ansible/roles/gitea-runner/tasks/rootless_docker.yml | 7 ++++++- 8 files changed, 15 insertions(+), 1 deletion(-) diff --git a/ansible/roles/gitea-runner/defaults/main.yml b/ansible/roles/gitea-runner/defaults/main.yml index d364fca..972bcf8 100644 --- a/ansible/roles/gitea-runner/defaults/main.yml +++ b/ansible/roles/gitea-runner/defaults/main.yml @@ -36,3 +36,5 @@ docker_apt_source_line: >- deb [arch={{ docker_apt_arch }} signed-by={{ docker_gpg_key_path }}] https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }} {{ ansible_facts['distribution_release'] }} stable +# Set to false in CI/molecule to skip rootless daemon startup (needs kernel userns) +docker_rootless_setup: true diff --git a/ansible/roles/gitea-runner/molecule/default/converge.yml b/ansible/roles/gitea-runner/molecule/default/converge.yml index efefd4c..9f0e1e2 100644 --- a/ansible/roles/gitea-runner/molecule/default/converge.yml +++ b/ansible/roles/gitea-runner/molecule/default/converge.yml @@ -7,5 +7,6 @@ registration_token: "fake-token-for-testing" runner_name: "molecule-test-runner" skip_runner_registration: true + docker_rootless_setup: false roles: - role: gitea-runner diff --git a/ansible/roles/gitea-runner/molecule/deregister/converge.yml b/ansible/roles/gitea-runner/molecule/deregister/converge.yml index 4d38b64..02353f7 100644 --- a/ansible/roles/gitea-runner/molecule/deregister/converge.yml +++ b/ansible/roles/gitea-runner/molecule/deregister/converge.yml @@ -7,5 +7,6 @@ registration_token: "fake-token-for-testing" runner_name: "deregister-test-runner" skip_runner_registration: true + docker_rootless_setup: false roles: - role: gitea-runner diff --git a/ansible/roles/gitea-runner/molecule/lifecycle/converge.yml b/ansible/roles/gitea-runner/molecule/lifecycle/converge.yml index 72419bc..8567ef2 100644 --- a/ansible/roles/gitea-runner/molecule/lifecycle/converge.yml +++ b/ansible/roles/gitea-runner/molecule/lifecycle/converge.yml @@ -7,5 +7,6 @@ registration_token: "fake-token-for-testing" runner_name: "lifecycle-test-runner" skip_runner_registration: true + docker_rootless_setup: false roles: - role: gitea-runner diff --git a/ansible/roles/gitea-runner/molecule/multi-instance/converge.yml b/ansible/roles/gitea-runner/molecule/multi-instance/converge.yml index ba72cc3..991877d 100644 --- a/ansible/roles/gitea-runner/molecule/multi-instance/converge.yml +++ b/ansible/roles/gitea-runner/molecule/multi-instance/converge.yml @@ -7,6 +7,7 @@ registration_token: "fake-token-for-testing" runner_name: "molecule-runner-a" skip_runner_registration: true + docker_rootless_setup: false roles: - role: gitea-runner @@ -18,5 +19,6 @@ registration_token: "fake-token-for-testing" runner_name: "molecule-runner-b" skip_runner_registration: true + docker_rootless_setup: false roles: - role: gitea-runner diff --git a/ansible/roles/gitea-runner/molecule/template-content/converge.yml b/ansible/roles/gitea-runner/molecule/template-content/converge.yml index dbabef5..81301ff 100644 --- a/ansible/roles/gitea-runner/molecule/template-content/converge.yml +++ b/ansible/roles/gitea-runner/molecule/template-content/converge.yml @@ -7,5 +7,6 @@ registration_token: "fake-token-for-testing" runner_name: "template-test-runner" skip_runner_registration: true + docker_rootless_setup: false roles: - role: gitea-runner diff --git a/ansible/roles/gitea-runner/molecule/update/converge.yml b/ansible/roles/gitea-runner/molecule/update/converge.yml index 8eeb6f3..8ad9eee 100644 --- a/ansible/roles/gitea-runner/molecule/update/converge.yml +++ b/ansible/roles/gitea-runner/molecule/update/converge.yml @@ -7,5 +7,6 @@ registration_token: "fake-token-for-testing" runner_name: "update-test-runner" skip_runner_registration: true + docker_rootless_setup: false roles: - role: gitea-runner diff --git a/ansible/roles/gitea-runner/tasks/rootless_docker.yml b/ansible/roles/gitea-runner/tasks/rootless_docker.yml index 1732e28..063482b 100644 --- a/ansible/roles/gitea-runner/tasks/rootless_docker.yml +++ b/ansible/roles/gitea-runner/tasks/rootless_docker.yml @@ -68,7 +68,9 @@ become_user: "{{ gitea_runner_service_user }}" environment: XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}" - when: not rootless_docker_check.stat.exists + when: + - docker_rootless_setup + - not rootless_docker_check.stat.exists - name: Start rootless Docker daemon (systemd user service) ansible.builtin.command: systemctl --user start docker @@ -77,6 +79,7 @@ environment: XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}" changed_when: true + when: docker_rootless_setup - name: Enable rootless Docker daemon (systemd user service) ansible.builtin.command: systemctl --user enable docker @@ -85,6 +88,7 @@ environment: XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}" changed_when: true + when: docker_rootless_setup - name: Wait for rootless Docker daemon to be ready ansible.builtin.command: docker version @@ -98,3 +102,4 @@ retries: 10 delay: 2 changed_when: false + when: docker_rootless_setup