dind

gitea-runner/main.yaml

@@ -63,7 +63,12 @@ spec:
         app.kubernetes.io/name: act-runner
     spec:
       containers:
-      - env:
+      - command:
+        - sh
+        - -c
+        - while ! nc -z localhost 2376 </dev/null; do echo 'waiting for docker daemon...';
+          sleep 5; done; /sbin/tini -- run.sh
+        env:
         - name: GITEA_INSTANCE_URL
           value: https://git.borninpain.de
         - name: GITEA_RUNNER_REGISTRATION_TOKEN
@@ -78,22 +83,30 @@ spec:
         - name: DOCKER_CERT_PATH
           value: /certs/client
         - name: DOCKER_TLS_VERIFY
-          value: "0"
-        image: docker.io/gitea/act_runner:0.2.11-dind-rootless
+          value: "1"
+        image: docker.io/gitea/act_runner:0.2.13
         imagePullPolicy: IfNotPresent
         name: act-runner
-        securityContext:
-          runAsUser: 1000
-          runAsGroup: 1000
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-              - ALL
         volumeMounts:
         - mountPath: /data
           name: data
         - mountPath: /config
           name: config
+        - mountPath: /certs
+          name: docker-certs
+      - env:
+        - name: DOCKER_TLS_CERTDIR
+          value: /certs
+        - mountPath: /certs
+          name: docker-certs
+        image: docker:23.0.6-dind
+        imagePullPolicy: IfNotPresent
+        name: docker-dind
+        securityContext:
+          privileged: true
+        volumeMounts:
+        - mountPath: /certs
+          name: docker-certs
       restartPolicy: Always
       securityContext:
         fsGroup: 1000
@@ -103,6 +116,8 @@ spec:
       - configMap:
           name: gitea-runner-act-runner-config
         name: config
+      - emptyDir: {}
+        name: docker-certs
   updateStrategy:
     type: RollingUpdate
   volumeClaimTemplates: