53 lines
2.4 KiB
Text
53 lines
2.4 KiB
Text
|
# MANAGED BY ANSIBLE - roles/forgejo_runner
|
||
|
|
#
|
||
|
|
# The isolated Docker daemon that Forgejo Actions jobs use. It runs ON this
|
||
|
|
# host's daemon but is a separate daemon: nothing a workflow does here can see
|
||
|
|
# or touch the host's containers, images or volumes.
|
||
|
|
[Unit]
|
||
|
|
Description=Docker-in-Docker daemon for Forgejo Actions jobs
|
||
|
|
Documentation=https://forgejo.org/docs/latest/admin/actions/docker-access/
|
||
|
|
After=docker.service
|
||
|
|
Requires=docker.service
|
||
|
|
|
||
|
|
[Service]
|
||
|
|
Type=simple
|
||
|
|
Restart=always
|
||
|
|
RestartSec=10
|
||
|
|
# dind pulls its image on first start and initialises /var/lib/docker; neither
|
||
|
|
# is fast on a cold volume, and a deadline here would just flap it.
|
||
|
|
TimeoutStartSec=0
|
||
|
|
|
||
|
|
# A container left behind by a hard kill would make `docker run --name` fail.
|
||
|
|
# Leading "-" so a clean start is not an error.
|
||
|
|
ExecStartPre=-/usr/bin/docker rm -f {{ forgejo_runner_dind_container }}
|
||
|
|
|
||
|
|
ExecStart=/usr/bin/docker run --rm --name {{ forgejo_runner_dind_container }} \
|
||
|
|
--privileged \
|
||
|
|
--publish {{ forgejo_runner_dind_bind_address }}:{{ forgejo_runner_dind_host_port }}:{{ forgejo_runner_dind_container_port }} \
|
||
|
|
--volume {{ forgejo_runner_dind_volume }}:/var/lib/docker \
|
||
|
|
--env DOCKER_TLS_CERTDIR= \
|
||
|
|
{{ forgejo_runner_dind_image }} \
|
||
|
|
dockerd \
|
||
|
|
--host=tcp://0.0.0.0:{{ forgejo_runner_dind_container_port }} \
|
||
|
|
--host=unix:///var/run/docker.sock \
|
||
|
|
--default-address-pool base={{ forgejo_runner_dind_address_pool }},size={{ forgejo_runner_dind_address_pool_size }}
|
||
|
|
|
||
|
|
# Hold the unit in "activating" until the daemon actually answers, so that
|
||
|
|
# forgejo-runner.service - which Requires= and After= this one - is never
|
||
|
|
# started against a socket that is not up yet. The runner does not retry: with
|
||
|
|
# an explicit container.docker_host it fails the connection and the job with it.
|
||
|
|
#
|
||
|
|
# Bounded by `timeout` rather than a counting loop, so a dind that never comes
|
||
|
|
# up FAILS this unit instead of hanging the boot. That is also the thing that
|
||
|
|
# catches a bad dockerd flag: the container exits, this never answers, and the
|
||
|
|
# unit goes red rather than the runner quietly losing Docker.
|
||
|
|
ExecStartPost=/usr/bin/timeout {{ forgejo_runner_dind_ready_timeout }} /bin/sh -c 'until /usr/bin/docker -H tcp://{{ forgejo_runner_dind_bind_address }}:{{ forgejo_runner_dind_host_port }} version >/dev/null 2>&1; do sleep 1; done'
|
||
|
|
|
||
|
|
ExecStop=/usr/bin/docker stop --time 30 {{ forgejo_runner_dind_container }}
|
||
|
|
|
||
|
|
StandardOutput=journal
|
||
|
|
StandardError=journal
|
||
|
|
|
||
|
|
[Install]
|
||
|
|
WantedBy=multi-user.target
|