Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
da86eb0e9d
Rootless Docker requires newuidmap/newgidmap kernel support which doesn't work in nested Docker containers (Operation not permitted). Added docker_rootless_setup variable (default true) to skip the daemon startup steps. Set to false in all molecule converge playbooks so tests verify package installation, user creation, service file rendering, and config without requiring a working rootless daemon. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
106 lines
3.2 KiB
YAML
106 lines
3.2 KiB
YAML
---
|
|
- name: Ensure keyrings directory exists (Debian/Ubuntu)
|
|
ansible.builtin.file:
|
|
path: "/etc/apt/keyrings"
|
|
state: directory
|
|
mode: "0755"
|
|
when: ansible_facts['os_family'] == 'Debian'
|
|
|
|
- name: Download and dearmor Docker GPG key (Debian/Ubuntu)
|
|
ansible.builtin.shell: |
|
|
set -o pipefail
|
|
curl -fsSL "https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}/gpg" | gpg --dearmor --yes -o {{ docker_gpg_key_path }}
|
|
args:
|
|
creates: "{{ docker_gpg_key_path }}"
|
|
executable: /bin/bash
|
|
when: ansible_facts['os_family'] == 'Debian'
|
|
|
|
- name: Add Docker APT repository (Debian/Ubuntu)
|
|
ansible.builtin.copy:
|
|
dest: /etc/apt/sources.list.d/docker.list
|
|
content: "{{ docker_apt_source_line }}\n"
|
|
mode: "0644"
|
|
when: ansible_facts['os_family'] == 'Debian'
|
|
|
|
- name: Update apt cache after adding Docker repo (Debian/Ubuntu)
|
|
ansible.builtin.apt:
|
|
update_cache: true
|
|
cache_valid_time: 0
|
|
when: ansible_facts['os_family'] == 'Debian'
|
|
|
|
- name: Install rootless Docker dependencies (Debian/Ubuntu)
|
|
ansible.builtin.apt:
|
|
name:
|
|
- uidmap
|
|
- slirp4netns
|
|
- fuse-overlayfs
|
|
- docker-ce
|
|
- docker-ce-cli
|
|
- docker-ce-rootless-extras
|
|
- containerd.io
|
|
- docker-compose-plugin
|
|
- rsync
|
|
state: present
|
|
when: ansible_facts['os_family'] == 'Debian'
|
|
|
|
- name: Install rootless Docker dependencies (Arch Linux)
|
|
community.general.pacman:
|
|
name:
|
|
- docker
|
|
- docker-compose
|
|
- slirp4netns
|
|
- fuse-overlayfs
|
|
- rsync
|
|
state: present
|
|
update_cache: true
|
|
when: ansible_facts['os_family'] == 'Archlinux'
|
|
|
|
- name: Check if rootless Docker is already set up
|
|
ansible.builtin.stat:
|
|
path: "{{ gitea_runner_home }}/.config/systemd/user/docker.service"
|
|
register: rootless_docker_check
|
|
|
|
- name: Set up rootless Docker for runner user
|
|
ansible.builtin.command: dockerd-rootless-setuptool.sh install
|
|
args:
|
|
creates: "{{ gitea_runner_home }}/.config/systemd/user/docker.service"
|
|
become: true
|
|
become_user: "{{ gitea_runner_service_user }}"
|
|
environment:
|
|
XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
|
|
when:
|
|
- docker_rootless_setup
|
|
- not rootless_docker_check.stat.exists
|
|
|
|
- name: Start rootless Docker daemon (systemd user service)
|
|
ansible.builtin.command: systemctl --user start docker
|
|
become: true
|
|
become_user: "{{ gitea_runner_service_user }}"
|
|
environment:
|
|
XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
|
|
changed_when: true
|
|
when: docker_rootless_setup
|
|
|
|
- name: Enable rootless Docker daemon (systemd user service)
|
|
ansible.builtin.command: systemctl --user enable docker
|
|
become: true
|
|
become_user: "{{ gitea_runner_service_user }}"
|
|
environment:
|
|
XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
|
|
changed_when: true
|
|
when: docker_rootless_setup
|
|
|
|
- name: Wait for rootless Docker daemon to be ready
|
|
ansible.builtin.command: docker version
|
|
become: true
|
|
become_user: "{{ gitea_runner_service_user }}"
|
|
environment:
|
|
DOCKER_HOST: "unix:///run/user/{{ gitea_runner_uid }}/docker.sock"
|
|
XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
|
|
register: docker_ready
|
|
until: docker_ready.rc == 0
|
|
retries: 10
|
|
delay: 2
|
|
changed_when: false
|
|
when: docker_rootless_setup
|