From 0444d265b9f846d647b81e1a969d2a97e145510a Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Mon, 4 May 2026 13:44:46 -0500
Subject: [PATCH] =?UTF-8?q?fix:=20gitea=20runner=20docker=5Fhost=20path=20?=
 =?UTF-8?q?mismatch=20=E2=80=94=20use=20/var/run/docker.sock?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The containerd socket is mounted from the host at /run/k3s/containerd/containerd.sock
to /var/run/docker.sock inside the container, but act_runner config was pointing to
the host path directly. Fixes CrashLoopBackOff on all runner pods.

Also codifies both deployments (will org + neuron-technologies org) as git-managed
manifests so Argo CD owns them going forward.
---
 .../legion/k8s/gitea-runner/deployment.yaml   | 168 ++++++++++++++++++
 1 file changed, 168 insertions(+)
 create mode 100644 servers/legion/k8s/gitea-runner/deployment.yaml

diff --git a/servers/legion/k8s/gitea-runner/deployment.yaml b/servers/legion/k8s/gitea-runner/deployment.yaml
new file mode 100644
index 0000000..7a0cfae
--- /dev/null
+++ b/servers/legion/k8s/gitea-runner/deployment.yaml
@@ -0,0 +1,168 @@
+---
+# Gitea Actions runner — will org
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gitea-runner
+  namespace: ci
+  labels:
+    app: gitea-runner
+  annotations:
+    config-version: "2026-05-04-docker-sock-fix"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: gitea-runner
+  template:
+    metadata:
+      labels:
+        app: gitea-runner
+      annotations:
+        config-version: "2026-05-04-docker-sock-fix"
+    spec:
+      securityContext:
+        runAsNonRoot: false
+      initContainers:
+        - name: register
+          image: registry.neuralplatform.ai/ci-base:latest
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              act_runner register \
+                --instance "$GITEA_INSTANCE_URL" \
+                --token "$GITEA_RUNNER_REGISTRATION_TOKEN" \
+                --name legion \
+                --labels "self-hosted:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-latest:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-24.04:docker://registry.neuralplatform.ai/ci-base:latest,linux,x64" \
+                --no-interactive
+              cat > /data/config.yaml << 'EOF'
+              runner:
+                capacity: 2
+                timeout: 3h
+              container:
+                network: host
+                docker_host: "unix:///var/run/docker.sock"
+                force_pull: false
+                valid_volumes: []
+                default_image: "registry.neuralplatform.ai/ci-base:latest"
+                extra_hosts:
+                  - "gitea.git.svc.cluster.local:10.43.1.53"
+              EOF
+          envFrom:
+            - secretRef:
+                name: gitea-runner-secret
+          volumeMounts:
+            - mountPath: /data
+              name: data
+          workingDir: /data
+      containers:
+        - name: runner
+          image: registry.neuralplatform.ai/ci-base:latest
+          command: ["act_runner", "daemon", "--config", "/data/config.yaml"]
+          envFrom:
+            - secretRef:
+                name: gitea-runner-secret
+          resources:
+            requests:
+              cpu: "250m"
+              memory: "512Mi"
+            limits:
+              cpu: "4"
+              memory: "4Gi"
+          volumeMounts:
+            - mountPath: /data
+              name: data
+            - mountPath: /var/run/docker.sock
+              name: docker-sock
+          workingDir: /data
+      volumes:
+        - name: data
+          emptyDir: {}
+        - name: docker-sock
+          hostPath:
+            path: /run/k3s/containerd/containerd.sock
+            type: Socket
+---
+# Gitea Actions runner — neuron-technologies org
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: neuron-technologies-runner
+  namespace: ci
+  labels:
+    app: neuron-technologies-runner
+  annotations:
+    config-version: "2026-05-04-docker-sock-fix"
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: neuron-technologies-runner
+  template:
+    metadata:
+      labels:
+        app: neuron-technologies-runner
+      annotations:
+        config-version: "2026-05-04-docker-sock-fix"
+    spec:
+      securityContext:
+        runAsNonRoot: false
+      initContainers:
+        - name: register
+          image: registry.neuralplatform.ai/ci-base:latest
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              act_runner register \
+                --instance "$GITEA_INSTANCE_URL" \
+                --token "$GITEA_RUNNER_REGISTRATION_TOKEN" \
+                --name "legion-nt-$(hostname)" \
+                --labels "self-hosted:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-latest:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-24.04:docker://registry.neuralplatform.ai/ci-base:latest,linux,x64" \
+                --no-interactive
+              cat > /data/config.yaml << 'EOF'
+              runner:
+                capacity: 2
+                timeout: 3h
+              container:
+                network: host
+                docker_host: "unix:///var/run/docker.sock"
+                force_pull: false
+                valid_volumes: []
+                default_image: "registry.neuralplatform.ai/ci-base:latest"
+                extra_hosts:
+                  - "gitea.git.svc.cluster.local:10.43.1.53"
+              EOF
+          envFrom:
+            - secretRef:
+                name: neuron-technologies-runner-secret
+          volumeMounts:
+            - mountPath: /data
+              name: data
+          workingDir: /data
+      containers:
+        - name: runner
+          image: registry.neuralplatform.ai/ci-base:latest
+          command: ["act_runner", "daemon", "--config", "/data/config.yaml"]
+          envFrom:
+            - secretRef:
+                name: neuron-technologies-runner-secret
+          resources:
+            requests:
+              cpu: "250m"
+              memory: "512Mi"
+            limits:
+              cpu: "4"
+              memory: "4Gi"
+          volumeMounts:
+            - mountPath: /data
+              name: data
+            - mountPath: /var/run/docker.sock
+              name: docker-sock
+          workingDir: /data
+      volumes:
+        - name: data
+          emptyDir: {}
+        - name: docker-sock
+          hostPath:
+            path: /run/k3s/containerd/containerd.sock
+            type: Socket