ozan
a81a450e7e
Merged into tinqs/studio: - cmd/tinqs-cli/ — tinqs-cli (Go binary, from bot/cli) - cmd/tea/ — Gitea CLI tool (from tinqs/cli-tea) - services/bot/ — Bot service (from tinqs-ltd/bot on git.arikigame.com) - services/admin/ — Admin panel (from tinqs/admin) - services/team-tool/ — Team Tool (from tinqs/team-tool) - services/proxy/ — tinqs-proxy (from bot/proxy) - web/landing/ — tinqs.com website (from tinqs/website) - web/docs/ — Platform docs (from tinqs/docs) - web/blog/ — Blog (placeholder) - runner/ — Ephemeral CI runner (from tinqs/runner) All source repos will be deleted after verification.
96 lines
2.9 KiB
Markdown
96 lines
2.9 KiB
Markdown
## Using Rootless Docker with`gitea-runner`
|
|
|
|
Here is a simple example of how to set up `gitea-runner` with rootless Docker. It has been created with Debian, but other Linux should work the same way.
|
|
|
|
Note: This procedure needs a real login shell -- using `sudo su` or other method of accessing the account will fail some of the steps below.
|
|
|
|
As `root`:
|
|
|
|
- Create a user to run both `docker` and `gitea-runner`. In this example, we use a non-privileged account called `rootless`.
|
|
|
|
```bash
|
|
useradd -m rootless
|
|
passwd rootless
|
|
apt-get install -y uidmap # Not mentioned but needed for docker rootless.
|
|
```
|
|
|
|
- Install [`docker-ce`](https://docs.docker.com/engine/install/)
|
|
- (Recommended) Disable the system-wide Docker daemon
|
|
|
|
``systemctl disable --now docker.service docker.socket``
|
|
|
|
As the `rootless` user:
|
|
|
|
- Follow the instructions for [enabling rootless mode](https://docs.docker.com/engine/security/rootless/)
|
|
- Add the following line to the `/home/rootless/.bashrc`:
|
|
|
|
```bash
|
|
for f in ./.bashrc.d/*.bash; do echo "Processing $f file..."; . "$f"; done
|
|
```
|
|
|
|
- Create the .bashrc.d directory `mkdir ~/.bashrc.d`
|
|
- Add the following lines to the `/home/rootless/.bashrc.d/rootless-docker.bash`:
|
|
|
|
```bash
|
|
export XDG_RUNTIME_DIR=/home/rootless/.docker/run
|
|
export PATH=/home/rootless/bin:$PATH
|
|
export DOCKER_HOST=unix:///run/user/$(id -u)/docker.sock
|
|
```
|
|
|
|
- Reboot. Ensure that the Docker process is working.
|
|
- Create a directory for saving `gitea-runner` data between restarts
|
|
|
|
`mkdir /home/rootless/gitea-runner`
|
|
|
|
- Register the runner from the data directory
|
|
|
|
```bash
|
|
cd /home/rootless/gitea-runner
|
|
gitea-runner register
|
|
```
|
|
|
|
- Generate a `gitea-runner` configuration file in the data directory. Edit the file to adjust for the system.
|
|
|
|
```bash
|
|
gitea-runner generate-config >/home/rootless/gitea-runner/config
|
|
```
|
|
|
|
- Create a new user-level`systemd` unit file as `/home/rootless/.config/systemd/user/gitea-runner.service` with the following contents:
|
|
|
|
```bash
|
|
Description=Gitea Actions runner
|
|
Documentation=https://gitea.com/gitea/runner
|
|
After=docker.service
|
|
|
|
[Service]
|
|
Environment=PATH=/home/rootless/bin:/sbin:/usr/sbin:/home/rootless/bin:/home/rootless/bin:/home/rootless/bin:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
|
|
Environment=DOCKER_HOST=unix:///run/user/1001/docker.sock
|
|
ExecStart=/usr/bin/gitea-runner daemon -c /home/rootless/gitea-runner/config
|
|
ExecReload=/bin/kill -s HUP $MAINPID
|
|
WorkingDirectory=/home/rootless/gitea-runner
|
|
TimeoutSec=0
|
|
RestartSec=2
|
|
Restart=always
|
|
StartLimitBurst=3
|
|
StartLimitInterval=60s
|
|
LimitNOFILE=infinity
|
|
LimitNPROC=infinity
|
|
LimitCORE=infinity
|
|
TasksMax=infinity
|
|
Delegate=yes
|
|
Type=notify
|
|
NotifyAccess=all
|
|
KillMode=mixed
|
|
|
|
[Install]
|
|
WantedBy=default.target
|
|
```
|
|
|
|
- Reboot
|
|
|
|
After the system restarts, check that the`gitea-runner` is working and that the runner is connected to Gitea.
|
|
|
|
````bash
|
|
systemctl --user status gitea-runner
|
|
journalctl --user -xeu gitea-runner
|