mirror of
https://gitea.com/gitea/runner.git
synced 2026-07-08 06:41:35 +08:00
silverwind
0ee4643d4a
Fixes: https://gitea.com/gitea/runner/issues/1061 Related: https://github.com/moby/moby/pull/52886 Docker 29.6.0 changed `dockerd` to shell out to the external `nft` binary for firewall-rule cleanup instead of linking `libnftables` (release note: *"Mitigate a crash in libnftables when using nftables as the firewall backend by changing the default build option to execute the `nft` command instead."*). The upstream `docker:dind` image only ships `iptables`/`ip6tables`, so `dockerd` logs `failed to find nft tool` on startup and shutdown. Networking is unaffected (default firewall backend is still iptables), but the errors are noisy. Install `nftables` in both dind variants to provide the binary. *PR authored by Claude (Opus 4.8).*Reviewed-on: https://gitea.com/gitea/runner/pulls/1064 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: silverwind <me@silverwind.io>
81 lines
1.7 KiB
Docker
81 lines
1.7 KiB
Docker
### BUILDER STAGE
|
|
#
|
|
#
|
|
FROM golang:1.26-alpine3.23 AS builder
|
|
|
|
# Do not remove `git` here, it is required for getting runner version when executing `make build`
|
|
RUN apk add --no-cache make git
|
|
|
|
ARG GOPROXY
|
|
ENV GOPROXY=${GOPROXY:-}
|
|
|
|
COPY . /opt/src/runner
|
|
WORKDIR /opt/src/runner
|
|
|
|
RUN make clean && make build
|
|
|
|
### DIND VARIANT
|
|
#
|
|
#
|
|
FROM docker:29.6.1-dind AS dind
|
|
|
|
ARG VERSION=dev
|
|
|
|
LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner"
|
|
LABEL org.opencontainers.image.version="${VERSION}"
|
|
|
|
RUN apk add --no-cache s6 bash git tzdata nftables
|
|
|
|
COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner
|
|
COPY scripts/run.sh /usr/local/bin/run.sh
|
|
COPY scripts/s6 /etc/s6
|
|
|
|
VOLUME /data
|
|
|
|
ENTRYPOINT ["s6-svscan","/etc/s6"]
|
|
|
|
### DIND-ROOTLESS VARIANT
|
|
#
|
|
#
|
|
FROM docker:29.6.1-dind-rootless AS dind-rootless
|
|
|
|
ARG VERSION=dev
|
|
|
|
LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner"
|
|
LABEL org.opencontainers.image.version="${VERSION}"
|
|
|
|
USER root
|
|
RUN apk add --no-cache s6 bash git tzdata nftables
|
|
|
|
COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner
|
|
COPY scripts/run.sh /usr/local/bin/run.sh
|
|
COPY scripts/s6 /etc/s6
|
|
|
|
VOLUME /data
|
|
|
|
RUN mkdir -p /data && chown -R rootless:rootless /etc/s6 /data
|
|
|
|
ENV DOCKER_HOST=unix:///run/user/1000/docker.sock
|
|
|
|
USER rootless
|
|
ENTRYPOINT ["s6-svscan","/etc/s6"]
|
|
|
|
### BASIC VARIANT
|
|
#
|
|
#
|
|
FROM alpine:3.24 AS basic
|
|
|
|
ARG VERSION=dev
|
|
|
|
LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner"
|
|
LABEL org.opencontainers.image.version="${VERSION}"
|
|
|
|
RUN apk add --no-cache tini bash git tzdata
|
|
|
|
COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner
|
|
COPY scripts/run.sh /usr/local/bin/run.sh
|
|
|
|
VOLUME /data
|
|
|
|
ENTRYPOINT ["/sbin/tini","--","run.sh"]
|