julien
efa660abab
## Summary `act_runner`'s default `container.force_pull: true` re-issues a `docker pull` at the start of every job, adding 10–30 s of registry round-trip even when every layer is already locally cached. With job images pinned to specific tags (`catthehacker/ubuntu:act-22.04` and `:full-22.04`), the implicit pull is pure overhead and contradicts the deliberate-upgrade policy ADR-0015 spells out for the runner image. - Add `infra/runner-config.yaml` with `container.force_pull: false`. - Mount it read-only into all three runners and point each at it via `CONFIG_FILE=/etc/runner/config.yaml`. - Document the pre-pull procedure and image-upgrade playbook in `infra/README.md` → "Job image pinning and pre-pull". - Fold the pre-pull into the "First-time registration" walkthrough so a fresh setup is correct end-to-end. The trade-off: the runner host must hold the images locally before the runner is asked to use them. Documented. ## Roll-out (manual, on the runner host) ```bash cd infra/ # 1. Pre-pull the job images (one-shot — pays the cold cost once). docker pull catthehacker/ubuntu:act-22.04 docker pull catthehacker/ubuntu:full-22.04 # 2. Recreate the runners so the new mount + env var take effect. docker compose -f ci-runners.compose.yml up -d --force-recreate --------- Co-authored-by: Julien Gautier <julien.gautier@apf.asso.fr> Reviewed-on: #10
94 lines
4.3 KiB
YAML
94 lines
4.3 KiB
YAML
# Self-hosted Gitea Actions runners — per ADR-0015 §"Runners".
|
|
#
|
|
# Three act_runner instances registered with the project's Gitea
|
|
# organisation, labelled self-hosted + on-prem (the labels referenced
|
|
# by every job in .gitea/workflows/*).
|
|
#
|
|
# First-time registration, scaling, image pinning, and security notes
|
|
# are documented in infra/README.md.
|
|
|
|
name: apf-portal-ci-runners
|
|
|
|
services:
|
|
runner-1:
|
|
image: gitea/act_runner:0.2.13
|
|
container_name: apf-portal-runner-1
|
|
restart: unless-stopped
|
|
environment:
|
|
GITEA_INSTANCE_URL: ${GITEA_INSTANCE_URL:?GITEA_INSTANCE_URL must be set in infra/.env}
|
|
GITEA_RUNNER_REGISTRATION_TOKEN: ${GITEA_RUNNER_REGISTRATION_TOKEN:-}
|
|
GITEA_RUNNER_NAME: apf-portal-runner-1
|
|
# Labels are formatted as <label>:docker://<image>. Without the
|
|
# docker:// suffix, act_runner uses a minimal default image with no
|
|
# Node, breaking any JavaScript action (actions/checkout etc.).
|
|
# catthehacker/ubuntu:act-22.04 is the de facto standard for
|
|
# act-compatible runners — bundles Node, Python, git, common build
|
|
# tools, and the Docker CLI.
|
|
GITEA_RUNNER_LABELS: self-hosted:docker://catthehacker/ubuntu:act-22.04,on-prem:docker://catthehacker/ubuntu:act-22.04
|
|
# Path of the shared act_runner config file inside the container,
|
|
# mounted read-only via volumes below (see infra/runner-config.yaml).
|
|
CONFIG_FILE: /etc/runner/config.yaml
|
|
volumes:
|
|
# Docker socket — see security note in infra/README.md.
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
# Persistent state: runner credentials live here after first registration.
|
|
- ./data/runner-1:/data
|
|
# Shared act_runner configuration — see infra/runner-config.yaml.
|
|
- ./runner-config.yaml:/etc/runner/config.yaml:ro
|
|
networks:
|
|
- act-runners
|
|
|
|
runner-2:
|
|
image: gitea/act_runner:0.2.13
|
|
container_name: apf-portal-runner-2
|
|
restart: unless-stopped
|
|
environment:
|
|
GITEA_INSTANCE_URL: ${GITEA_INSTANCE_URL:?GITEA_INSTANCE_URL must be set in infra/.env}
|
|
GITEA_RUNNER_REGISTRATION_TOKEN: ${GITEA_RUNNER_REGISTRATION_TOKEN:-}
|
|
GITEA_RUNNER_NAME: apf-portal-runner-2
|
|
# Labels are formatted as <label>:docker://<image>. Without the
|
|
# docker:// suffix, act_runner uses a minimal default image with no
|
|
# Node, breaking any JavaScript action (actions/checkout etc.).
|
|
# catthehacker/ubuntu:act-22.04 is the de facto standard for
|
|
# act-compatible runners — bundles Node, Python, git, common build
|
|
# tools, and the Docker CLI.
|
|
GITEA_RUNNER_LABELS: self-hosted:docker://catthehacker/ubuntu:act-22.04,on-prem:docker://catthehacker/ubuntu:act-22.04
|
|
# Path of the shared act_runner config file inside the container,
|
|
# mounted read-only via volumes below (see infra/runner-config.yaml).
|
|
CONFIG_FILE: /etc/runner/config.yaml
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- ./data/runner-2:/data
|
|
- ./runner-config.yaml:/etc/runner/config.yaml:ro
|
|
networks:
|
|
- act-runners
|
|
|
|
runner-3:
|
|
image: gitea/act_runner:0.2.13
|
|
container_name: apf-portal-runner-3
|
|
restart: unless-stopped
|
|
environment:
|
|
GITEA_INSTANCE_URL: ${GITEA_INSTANCE_URL:?GITEA_INSTANCE_URL must be set in infra/.env}
|
|
GITEA_RUNNER_REGISTRATION_TOKEN: ${GITEA_RUNNER_REGISTRATION_TOKEN:-}
|
|
GITEA_RUNNER_NAME: apf-portal-runner-3
|
|
# Labels are formatted as <label>:docker://<image>. Without the
|
|
# docker:// suffix, act_runner uses a minimal default image with no
|
|
# Node, breaking any JavaScript action (actions/checkout etc.).
|
|
# catthehacker/ubuntu:act-22.04 is the de facto standard for
|
|
# act-compatible runners — bundles Node, Python, git, common build
|
|
# tools, and the Docker CLI.
|
|
GITEA_RUNNER_LABELS: self-hosted:docker://catthehacker/ubuntu:act-22.04,on-prem:docker://catthehacker/ubuntu:act-22.04
|
|
# Path of the shared act_runner config file inside the container,
|
|
# mounted read-only via volumes below (see infra/runner-config.yaml).
|
|
CONFIG_FILE: /etc/runner/config.yaml
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- ./data/runner-3:/data
|
|
- ./runner-config.yaml:/etc/runner/config.yaml:ro
|
|
networks:
|
|
- act-runners
|
|
|
|
networks:
|
|
act-runners:
|
|
name: apf-portal-act-runners
|