56c3e51657
runner-config.yaml: correct path to /srv/gitea-workspace (VPS, not Synology). docker-compose.observability.yml: revert 5 bind mounts to plain relative paths; OBS_CONFIG_DIR variable is no longer needed. nightly.yml / release.yml: remove OBS_CONFIG_DIR env injection and the "Sync observability configs to host" step from both workflows. With workdir_parent=/srv/gitea-workspace and an identical host<->container bind mount, $(pwd) inside job containers resolves to a real host path the daemon can find — no privileged container, no overlay2 inspection, no nsenter. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
27 lines
1.4 KiB
YAML
27 lines
1.4 KiB
YAML
# runner-config.yaml — only the relevant section
|
|
container:
|
|
# passed as DOCKER_HOST inside the job container
|
|
docker_host: "unix:///var/run/docker.sock"
|
|
# Job workspaces are stored here on the NAS and mounted at the same
|
|
# absolute path inside job containers. Identical host ↔ container path
|
|
# is the requirement: Docker Compose resolves relative bind mounts to
|
|
# $(pwd) inside the job container and passes that absolute path to the
|
|
# host daemon — the daemon must find the file at that exact host path.
|
|
# Prerequisite: mkdir -p /srv/gitea-workspace on the host, and add
|
|
# - /srv/gitea-workspace:/srv/gitea-workspace
|
|
# to the runner service volumes in gitea's compose.yaml.
|
|
workdir_parent: /srv/gitea-workspace
|
|
# whitelists volumes that workflow steps may bind-mount
|
|
valid_volumes:
|
|
- "/var/run/docker.sock"
|
|
- "/srv/gitea-workspace"
|
|
# appended to `docker run` when the runner spawns a job container
|
|
# SECURITY: Mounting the Docker socket grants job containers root-equivalent
|
|
# access to the host Docker daemon. Acceptable here because only trusted code
|
|
# from this private repo runs on this runner. Do NOT use on a runner that
|
|
# accepts untrusted PRs from external contributors.
|
|
options: "-v /var/run/docker.sock:/var/run/docker.sock -v /srv/gitea-workspace:/srv/gitea-workspace"
|
|
# keep network mode default (bridge) — Testcontainers handles its own networking
|
|
force_pull: false
|
|
|