fix: pre-configure daemon.json before rootless setuptool + add DBUS_SESSION_BUS_ADDRESS

Five fixes for rootless Docker setup on Arch Linux runners:

1. Write daemon.json (with containerd-snapshotter: false) BEFORE running
   dockerd-rootless-setuptool.sh, so Docker 29 starts with overlay2 from
   the very first boot instead of containerd snapshots.

2. Add DBUS_SESSION_BUS_ADDRESS to all systemctl --user tasks. Without it,
   systemctl --user fails with "Connection refused" on Arch Linux where
   the D-Bus session bus isn't auto-discovered.

3. Fix pre-configure override port driver: use 'builtin' for slirp4netns
   and 'implicit' only for pasta. The previous unconditional 'implicit'
   caused dockerd to exit immediately on slirp4netns hosts.

4. Fix prune timer schedule from '*-* * */6:00:00' (invalid) to
   '*-*-* 00/6:00:00' (every 6 hours, valid systemd calendar spec).

5. Add explicit Docker 29→28 downgrade task for Debian/Ubuntu using
   version-pinned apt install with allow_downgrades.

Closes GRM-158

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

ansible/roles/gitea_runner/defaults/main.yml

@@ -22,7 +22,7 @@ gitea_runner_prune_until: "24h"
 # of images per day. Accumulation between daily runs can trigger Docker
 # daemon instability (containerd snapshotter GC holds locks, blocking
 # container operations).
-gitea_runner_prune_schedule: "*-* * */6:00:00"
+gitea_runner_prune_schedule: "*-*-* 00/6:00:00"
 gitea_runner_prune_label: "gitea-runner=true"
 
 # Service configuration

ansible/roles/gitea_runner/tasks/deregister.yml

@@ -29,6 +29,7 @@
   become_user: "{{ gitea_runner_service_user }}"
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid | default(0) }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
     DOCKER_HOST: "unix:///run/user/{{ gitea_runner_uid | default(0) }}/docker.sock"
   when:
     - gitea_runner_file_stat.stat.exists | default(false) | bool

ansible/roles/gitea_runner/tasks/healthcheck.yml

@@ -29,6 +29,7 @@
   become_user: "{{ gitea_runner_service_user }}"
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
   changed_when: true
   when:
     - gitea_runner_systemd_available.stat.exists
@@ -40,6 +41,7 @@
   become_user: "{{ gitea_runner_service_user }}"
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
   changed_when: true
   when:
     - gitea_runner_systemd_available.stat.exists

ansible/roles/gitea_runner/tasks/integration_test.yml

@@ -24,6 +24,7 @@
   become_user: "{{ gitea_runner_service_user }}"
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
   register: gitea_runner_service_check
   changed_when: false
   retries: 10

ansible/roles/gitea_runner/tasks/pre_pull_images.yml

@@ -16,6 +16,7 @@
   environment:
     DOCKER_HOST: "unix:///run/user/{{ gitea_runner_uid }}/docker.sock"
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
   register: gitea_runner_pre_pull_result
   changed_when: "'Status: Downloaded' in gitea_runner_pre_pull_result.stdout or 'Status: Downloaded' in gitea_runner_pre_pull_result.stderr"
   retries: 3

ansible/roles/gitea_runner/tasks/prune.yml

@@ -21,6 +21,7 @@
   become_user: "{{ gitea_runner_service_user }}"
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
   changed_when: true
   when:
     - gitea_runner_systemd_available.stat.exists
@@ -32,6 +33,7 @@
   become_user: "{{ gitea_runner_service_user }}"
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
   changed_when: true
   when:
     - gitea_runner_systemd_available.stat.exists

ansible/roles/gitea_runner/tasks/register.yml

@@ -26,6 +26,7 @@
   become_user: "{{ gitea_runner_service_user }}"
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid | default(0) }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
     DOCKER_HOST: "unix:///run/user/{{ gitea_runner_uid | default(0) }}/docker.sock"
   when: not gitea_runner_registered.stat.exists
   register: gitea_runner_register_output

ansible/roles/gitea_runner/tasks/rootless_docker.yml

@@ -45,8 +45,20 @@
       Pin: version 5:28.*
       Pin-Priority: 1000
     mode: "0644"
+  register: gitea_runner_docker_pin
   when: ansible_facts['os_family'] == 'Debian'
 
+- name: Update apt cache after pinning Docker (Debian/Ubuntu)
+  ansible.builtin.apt:
+    update_cache: true
+  when:
+    - ansible_facts['os_family'] == 'Debian'
+    - gitea_runner_docker_pin is changed
+
+# Install Docker packages. The APT pin (priority 1000) makes 28.x the
+# candidate, so state: present installs 28.x on fresh systems. On systems
+# where Docker 29 was previously installed, a separate downgrade task
+# handles the version pin.
 - name: Install rootless Docker dependencies (Debian/Ubuntu)
   ansible.builtin.apt:
     name:
@@ -61,8 +73,29 @@
       - docker-compose-plugin
       - rsync
     state: present
+  register: gitea_runner_docker_install
   when: ansible_facts['os_family'] == 'Debian'
 
+# Downgrade Docker 29 → 28 if needed. state: present won't downgrade,
+# so we check the installed version and force-install the pinned version.
+- name: Check installed Docker version (Debian/Ubuntu)
+  ansible.builtin.command: dpkg-query -W -f='${Version}' docker-ce
+  changed_when: false
+  register: gitea_runner_installed_docker_version
+  when: ansible_facts['os_family'] == 'Debian'
+
+- name: Downgrade Docker to 28.x if 29.x is installed (Debian/Ubuntu)
+  ansible.builtin.apt:
+    name:
+      - docker-ce=5:28.*
+      - docker-ce-cli=5:28.*
+      - docker-ce-rootless-extras=5:28.*
+    state: present
+    allow_downgrades: true
+  when:
+    - ansible_facts['os_family'] == 'Debian'
+    - "'29.' in gitea_runner_installed_docker_version.stdout"
+
 - name: Update pacman cache (Arch Linux)
   community.general.pacman:
     update_cache: true
@@ -149,8 +182,57 @@
     content: |
       [Service]
       Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_NET={{ gitea_runner_docker_rootless_net_driver }}"
-      Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=implicit"
+      Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER={{ 'implicit' if gitea_runner_docker_rootless_net_driver == 'pasta' else 'builtin' }}"
+      {% if gitea_runner_docker_rootless_net_driver == 'pasta' %}
       Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS=--ipv6"
+      {% endif %}
+    mode: "0644"
+    owner: "{{ gitea_runner_service_user }}"
+    group: "{{ gitea_runner_service_user }}"
+  when:
+    - gitea_runner_docker_rootless_setup
+    - not gitea_runner_rootless_docker_check.stat.exists
+
+# Write daemon.json BEFORE the setuptool starts dockerd, so Docker 29
+# starts with containerd snapshotter disabled from the very first boot.
+# Without this, Docker 29 uses containerd snapshots by default, which
+# causes instability in rootless mode.
+- name: Ensure Docker config directory exists (pre-setup)
+  ansible.builtin.file:
+    path: "{{ gitea_runner_home }}/.config/docker"
+    state: directory
+    mode: "0755"
+    owner: "{{ gitea_runner_service_user }}"
+    group: "{{ gitea_runner_service_user }}"
+  when:
+    - gitea_runner_docker_rootless_setup
+    - not gitea_runner_rootless_docker_check.stat.exists
+
+- name: Pre-configure rootless Docker daemon.json (disable containerd snapshotter)
+  ansible.builtin.copy:
+    dest: "{{ gitea_runner_home }}/.config/docker/daemon.json"
+    content: |
+      {
+        "live-restore": {{ gitea_runner_docker_live_restore | to_json }},
+        "shutdown-timeout": {{ gitea_runner_docker_shutdown_timeout }},
+        "max-concurrent-downloads": {{ gitea_runner_docker_max_concurrent_downloads }},
+        "max-concurrent-uploads": {{ gitea_runner_docker_max_concurrent_uploads }},
+        "default-ulimits": {
+          "nofile": {"Name": "nofile", "Hard": {{ gitea_runner_docker_default_nofile }}, "Soft": {{ gitea_runner_docker_default_nofile }}}
+        },
+        "features": {
+          "containerd-snapshotter": false
+        },
+        {% if gitea_runner_docker_rootless_net_driver == 'pasta' %}
+        "ipv6": true,
+        "ip6tables": true,
+        "fixed-cidr-v6": "{{ gitea_runner_docker_ipv6_cidr }}",
+        "dns": ["10.0.2.3", "8.8.8.8"]
+        {% else %}
+        "ipv6": false,
+        "dns": ["8.8.8.8", "1.1.1.1"]
+        {% endif %}
+      }
     mode: "0644"
     owner: "{{ gitea_runner_service_user }}"
     group: "{{ gitea_runner_service_user }}"
@@ -166,6 +248,7 @@
   become_user: "{{ gitea_runner_service_user }}"
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid }}/bus"
     DOCKERD_ROOTLESS_ROOTLESSKIT_NET: "{{ gitea_runner_docker_rootless_net_driver }}"
   when:
     - gitea_runner_docker_rootless_setup
@@ -177,6 +260,7 @@
   become_user: "{{ gitea_runner_service_user }}"
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid }}/bus"
   changed_when: true
   when: gitea_runner_docker_rootless_setup
 
@@ -186,6 +270,7 @@
   become_user: "{{ gitea_runner_service_user }}"
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid }}/bus"
   changed_when: true
   when: gitea_runner_docker_rootless_setup
 
@@ -220,6 +305,7 @@
   become_user: "{{ gitea_runner_service_user }}"
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid }}/bus"
   changed_when: true
   when:
     - gitea_runner_docker_rootless_setup
@@ -262,6 +348,7 @@
   become_user: "{{ gitea_runner_service_user }}"
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid }}/bus"
   changed_when: true
   when:
     - gitea_runner_docker_rootless_setup
@@ -274,6 +361,7 @@
   environment:
     DOCKER_HOST: "unix:///run/user/{{ gitea_runner_uid }}/docker.sock"
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid }}/bus"
   register: gitea_runner_docker_ready
   until: gitea_runner_docker_ready.rc == 0
   retries: 10

ansible/roles/gitea_runner/tasks/service.yml

@@ -13,6 +13,7 @@
   become_user: "{{ gitea_runner_service_user }}"
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
   changed_when: true
   when:
     - gitea_runner_systemd_available.stat.exists
@@ -24,6 +25,7 @@
   become_user: "{{ gitea_runner_service_user }}"
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
   changed_when: true
   when:
     - gitea_runner_systemd_available.stat.exists

ansible/roles/gitea_runner/tasks/update_runner.yml

@@ -8,6 +8,7 @@
   become_user: "{{ gitea_runner_service_user }}"
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
   when:
     - gitea_runner_systemd_available.stat.exists | default(false) | bool
     - gitea_runner_docker_rootless_setup

ansible/roles/gitea_runner/tasks/validate.yml

@@ -21,6 +21,7 @@
   environment:
     DOCKER_HOST: "unix:///run/user/{{ gitea_runner_uid }}/docker.sock"
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
   register: gitea_runner_docker_version_output
   changed_when: false
   when: gitea_runner_docker_rootless_setup