forgejo-runner: try to configure dind

inventories/chaosknoten/host_vars/forgejo-runner.yaml

@@ -1 +1,2 @@
 forgejo_runner__config: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/forgejo-runner/forgejo-runner/configuration.yaml.j2') }}"
+forgejo_runner__enable_dind: true

resources/chaosknoten/forgejo-runner/forgejo-runner/configuration.yaml.j2

@@ -23,6 +23,8 @@ runner:
     - alpine:docker://docker.io/library/alpine:latest
     # Debian
     - debian:docker://docker.io/library/debian:latest
+  envs:
+    DOCKER_HOST: tcp://dind_container.docker.internal:2375
 
 cache:
   enabled: false
@@ -40,7 +42,8 @@ container:
   ## Add /etc/gvisor-helper-resolv.conf to valid_volumes to make the bind-mount in options work.
   ## valid_volumes: ["/etc/gvisor-helper-resolv.conf:ro"]
   # Leave "-", so no docker host will be mounted in the job container.
-  docker_host: "-"
+  docker_host: "tcp://127.0.0.1:2376"
+  options: "--add-host=dind_container.docker.internal:host-gateway"
   force_pull: true
   force_rebuild: false
 

roles/forgejo_runner/README.md

@@ -7,3 +7,8 @@ See: https://forgejo.org/docs/latest/admin/actions/
 
 - `forgejo_runner__config`: The configuration to run the Forgejo Runner with.  
   A configuration can be generated using `forgejo-runner generate-config`. Also see the [relevant docs](https://forgejo.org/docs/latest/admin/actions/configuration/).
+
+## Optional Arguments
+
+- `forgejo_runner__enable_dind`: set up a Docker-in-Docker (dind) service alongside the runner.
+  You will need to adjust the runner configuration as explained in [Utilizing Docker within Actions: Docker-in-Docker](https://forgejo.org/docs/latest/admin/actions/docker-access/#docker-in-docker).

roles/forgejo_runner/defaults/main.yaml

@@ -0,0 +1,2 @@
+# Set up Docker in Docker on the runner host, and mount it into the runner
+forgejo_runner__enable_dind: false

roles/forgejo_runner/files/forgejo-docker-in-docker.service

@@ -0,0 +1,24 @@
+[Unit]
+Description=Forgejo Docker in Docker
+Documentation=https://forgejo.org/docs/latest/admin/actions/docker-access/#docker-in-docker
+After=docker.service
+Requires=docker.service
+
+[Service]
+ExecStart=/usr/bin/docker run \
+  -p 127.0.0.1:2376:2375 \
+  --rm \
+  --privileged \
+  --name dind_container \
+  docker:dind \
+  dockerd -H tcp://0.0.0.0:2375 --tls=false
+ExecStop=/usr/bin/docker stop dind_container
+
+User=runner
+WorkingDirectory=/home/runner
+Restart=on-failure
+TimeoutSec=0
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target

roles/forgejo_runner/tasks/main/02_setup.yaml

@@ -38,9 +38,30 @@
     - systemd daemon reload
     - restart the forgejo-runner service
 
+- name: ensure systemd service for dind exists
+  ansible.builtin.copy:
+    src: forgejo-docker-in-docker.service
+    dest: /etc/systemd/system/forgejo-docker-in-docker.service
+    owner: root
+    group: root
+    mode: "0644"
+  become: true
+  when: forgejo_runner__enable_dind
+  notify:
+    - systemd daemon reload
+    - restart the forgejo-runner service
+
 - name: ensure systemd service is started and enabled
   ansible.builtin.systemd_service:
     name: forgejo-runner.service
     state: started
     enabled: true
   become: true
+
+- name: ensure systemd service for dind is started and enabled
+  ansible.builtin.systemd_service:
+    name: forgejo-docker-in-docker.service
+    state: started
+    enabled: true
+  become: true
+  when: forgejo_runner__enable_dind