Revert CI to host Docker socket, remove buildkitd

BuildKit rootless failed on k3s (mount propagation), privileged mode fixed that but buildkitd gRPC is incompatible with the Docker REST API that forgejo-runner needs to manage job containers. Net security change vs. the original socket approach was zero (privileged ≈ socket access). Remove buildkitd.yaml entirely. Restore docker-sock hostPath mount on both runners. Builds work again.
2026-04-26 02:50:27 -05:00
parent e18d953ff9
commit 2550786965
2 changed files with 19 additions and 82 deletions
@@ -1,68 +0,0 @@
---
-# BuildKit daemon — privileged image builder for CI runners.
-# Runs as root with privileged=true in the isolated ci namespace.
-# Rootless mode (moby/buildkit:*-rootless) fails on k3s/containerd because
-# rootlesskit cannot share mount propagation on the container root fs.
-#
-# Runners connect via TCP: DOCKER_HOST=tcp://buildkitd.ci.svc.cluster.local:1234
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: buildkitd
-  namespace: ci
-  labels:
-    app: buildkitd
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: buildkitd
-  template:
-    metadata:
-      labels:
-        app: buildkitd
-    spec:
-      containers:
-        - name: buildkitd
-          image: moby/buildkit:v0.19.0
-          args:
-            - --addr
-            - tcp://0.0.0.0:1234
-            - --addr
-            - unix:///run/buildkit/buildkitd.sock
-          ports:
-            - name: tcp
-              containerPort: 1234
-          securityContext:
-            privileged: true
-          readinessProbe:
-            tcpSocket:
-              port: 1234           # k3s/containerd can't exec into privileged containers
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          resources:
-            requests:
-              cpu: 200m
-              memory: 256Mi
-            limits:
-              cpu: "4"
-              memory: 4Gi
-          volumeMounts:
-            - name: buildkit-storage
-              mountPath: /var/lib/buildkit
-      volumes:
-        - name: buildkit-storage
-          emptyDir: {}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: buildkitd
-  namespace: ci
-spec:
-  selector:
-    app: buildkitd
-  ports:
-    - name: tcp
-      port: 1234
-      targetPort: 1234