Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
8ffd8436c8
Rootless Docker cannot set RLIMIT_NOFILE to 1048576 on all hosts (notably Arch Linux with Docker 29), causing container creation to fail with "error setting rlimit type 7: operation not permitted". 65536 is a safe value that works across all supported platforms. Closes GRM-158 Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
104 lines
5.2 KiB
YAML
104 lines
5.2 KiB
YAML
---
|
|
gitea_runner_version: "2.0.1"
|
|
gitea_runner_labels: "docker,ubuntu-latest:docker://runner-images:ubuntu-26.04"
|
|
gitea_runner_skip_registration: false
|
|
|
|
# Per-runner user (rootless isolation)
|
|
gitea_runner_user_prefix: "grm-"
|
|
gitea_runner_base_home: "/home"
|
|
gitea_runner_service_user: "{{ gitea_runner_user_prefix }}{{ gitea_runner_name }}"
|
|
gitea_runner_home: "{{ gitea_runner_base_home }}/{{ gitea_runner_service_user }}"
|
|
|
|
# Base paths (instance-scoped via gitea_runner_name)
|
|
gitea_runner_base_data_dir: "/var/lib/gitea-runner"
|
|
gitea_runner_base_config_dir: "/etc/gitea-runner"
|
|
gitea_runner_data_dir: "{{ gitea_runner_base_data_dir }}/{{ gitea_runner_name }}"
|
|
gitea_runner_config_dir: "{{ gitea_runner_base_config_dir }}/{{ gitea_runner_name }}"
|
|
gitea_runner_binary_path: "/usr/local/bin/gitea_runner"
|
|
|
|
# Prune configuration
|
|
gitea_runner_prune_until: "24h"
|
|
# Every 6 hours — daily is insufficient for CI runners that build dozens
|
|
# of images per day. Accumulation between daily runs can trigger Docker
|
|
# daemon instability (containerd snapshotter GC holds locks, blocking
|
|
# container operations).
|
|
gitea_runner_prune_schedule: "*-*-* 00/6:00:00"
|
|
gitea_runner_prune_label: "gitea-runner=true"
|
|
|
|
# Service configuration
|
|
gitea_runner_service_restart_sec: "5"
|
|
|
|
# Health check configuration
|
|
# 2min interval — catches hung daemons before multiple CI jobs fail between checks.
|
|
# The previous 5min interval was too coarse: a stuck daemon could fail 3+ molecule
|
|
# jobs in the window between healthcheck runs.
|
|
gitea_runner_healthcheck_interval: "2min"
|
|
gitea_runner_healthcheck_boot_delay: "2min"
|
|
gitea_runner_healthcheck_disk_threshold: 75
|
|
gitea_runner_healthcheck_script_path: "{{ gitea_runner_config_dir }}/healthcheck.sh"
|
|
|
|
# Docker daemon resilience settings (applied to daemon.json).
|
|
# live-restore: containers survive daemon restarts — prevents stuck container
|
|
# states when the healthcheck restarts a hung daemon.
|
|
# shutdown-timeout: grace period (seconds) for containers to stop on daemon
|
|
# shutdown/restart. Default 15s is too short for DinD containers with nested
|
|
# processes (molecule tests). 30s gives SIGTERM time to propagate.
|
|
# max-concurrent-downloads/uploads: limits parallel transfers to reduce daemon
|
|
# memory pressure when multiple CI jobs pull images simultaneously.
|
|
# default-ulimits: prevents FD exhaustion in container processes.
|
|
gitea_runner_docker_live_restore: true
|
|
gitea_runner_docker_shutdown_timeout: 30
|
|
gitea_runner_docker_max_concurrent_downloads: 3
|
|
gitea_runner_docker_max_concurrent_uploads: 3
|
|
gitea_runner_docker_default_nofile: 65536
|
|
|
|
# Admin token for runner deregistration via Gitea API.
|
|
# If not set, falls back to registration_token (which likely lacks admin scope).
|
|
# Set this to a token with admin scope to enable automatic runner cleanup on removal.
|
|
gitea_runner_admin_token: ""
|
|
|
|
# Removal defaults
|
|
gitea_runner_remove_systemd_template: true
|
|
gitea_runner_remove_user: true
|
|
|
|
# Runner configuration
|
|
gitea_runner_log_level: "info"
|
|
gitea_runner_container_label: "gitea-runner=true"
|
|
gitea_runner_file: ".runner"
|
|
|
|
# Docker installation (for rootless dependencies)
|
|
gitea_runner_docker_gpg_key_path: "/etc/apt/keyrings/docker.gpg"
|
|
gitea_runner_docker_apt_arch: "{{ 'amd64' if ansible_facts['architecture'] == 'x86_64' else ansible_facts['architecture'] }}"
|
|
gitea_runner_docker_apt_source_line: >-
|
|
deb [arch={{ gitea_runner_docker_apt_arch }} signed-by={{ gitea_runner_docker_gpg_key_path }}]
|
|
https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}
|
|
{{ ansible_facts['distribution_release'] }} stable
|
|
# Set to false in CI/molecule to skip rootless daemon startup (needs kernel userns)
|
|
gitea_runner_docker_rootless_setup: true
|
|
|
|
# Rootless Docker helper scripts (dockerd-rootless-setuptool.sh / dockerd-rootless.sh).
|
|
# Arch Linux's "docker" package does not ship these (unlike Debian's docker-ce-rootless-extras),
|
|
# and no official Arch package provides them. They are fetched from the upstream moby/moby
|
|
# "contrib/" directory at the git ref below. The scripts are stable bash wrappers that are
|
|
# version-agnostic with respect to the dockerd binary, so a pinned ref is safe.
|
|
gitea_runner_rootless_scripts_ref: "v28.5.1"
|
|
# Install dir MUST match the location of the "docker" / "dockerd" / "rootlesskit" binaries so
|
|
# that dockerd-rootless-setuptool.sh (which derives BIN from its own dirname) finds them co-located.
|
|
gitea_runner_rootless_scripts_install_dir: "/usr/bin"
|
|
|
|
# Rootless Docker network driver: "slirp4netns" (default) or "pasta" (IPv6 support)
|
|
# slirp4netns is the default because pasta has a TCP proxy bug that sends RST
|
|
# packets with wrong sequence numbers, breaking TCP connections from Docker
|
|
# containers to external hosts. slirp4netns doesn't have IPv6 support.
|
|
# See: https://bugs.passt.top/show_bug.cgi?id=52
|
|
gitea_runner_docker_rootless_net_driver: "slirp4netns"
|
|
|
|
# IPv6 subnet for rootless Docker containers (ULA range, not routable on internet)
|
|
gitea_runner_docker_ipv6_cidr: "fd00:dead:beef::/48"
|
|
|
|
# Pre-pull Docker images that CI runners need (avoids pulling on every CI run).
|
|
# The runner container image (ci-full) is large (~3.3GB) and the healthcheck's
|
|
# disk-space prune only removes dangling images, so pre-pulled tagged images persist.
|
|
# Set to [] to skip pre-pulling. Images are pulled as the runner user via rootless Docker.
|
|
gitea_runner_pre_pull_images: []
|