From 2550786965c254b4ff15dda2871e8673f0de0b22 Mon Sep 17 00:00:00 2001 From: Will Anderson Date: Sun, 26 Apr 2026 02:50:27 -0500 Subject: [PATCH] Revert CI to host Docker socket, remove buildkitd MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit BuildKit rootless failed on k3s (mount propagation), privileged mode fixed that but buildkitd gRPC is incompatible with the Docker REST API that forgejo-runner needs to manage job containers. Net security change vs. the original socket approach was zero (privileged ≈ socket access). Remove buildkitd.yaml entirely. Restore docker-sock hostPath mount on both runners. Builds work again. --- servers/legion/apps/gitea-runner.yaml | 33 +++++---- .../legion/k8s/gitea-runner/buildkitd.yaml | 68 ------------------- 2 files changed, 19 insertions(+), 82 deletions(-) delete mode 100644 servers/legion/k8s/gitea-runner/buildkitd.yaml diff --git a/servers/legion/apps/gitea-runner.yaml b/servers/legion/apps/gitea-runner.yaml index 29ff958..320faa2 100644 --- a/servers/legion/apps/gitea-runner.yaml +++ b/servers/legion/apps/gitea-runner.yaml @@ -1,7 +1,6 @@ --- # Gitea CI runner — general-purpose (legion) -# Docker socket REMOVED. Builds go through buildkitd TCP endpoint. -# Set DOCKER_HOST=tcp://buildkitd.ci.svc.cluster.local:1234 in build steps. +# Uses host Docker socket for container management and docker build/push. apiVersion: apps/v1 kind: Deployment metadata: @@ -19,7 +18,7 @@ spec: labels: app: gitea-runner annotations: - config-version: "2026-04-25-buildkit-no-sock" + config-version: "2026-04-26-docker-sock" spec: securityContext: runAsNonRoot: false # act_runner needs root for container management @@ -42,7 +41,7 @@ spec: timeout: 3h container: network: host - docker_host: "tcp://buildkitd.ci.svc.cluster.local:1234" + docker_host: "unix:///var/run/docker.sock" force_pull: false valid_volumes: [] default_image: "registry.neuralplatform.ai/ci-base:latest" @@ -60,16 +59,14 @@ spec: image: registry.neuralplatform.ai/ci-base:latest workingDir: /data command: ["act_runner", "daemon", "--config", "/data/config.yaml"] - env: - - name: DOCKER_HOST - value: "tcp://buildkitd.ci.svc.cluster.local:1234" envFrom: - secretRef: name: gitea-runner-secret volumeMounts: - name: data mountPath: /data - # docker-sock volume intentionally removed — use buildkitd TCP instead + - name: docker-sock + mountPath: /var/run/docker.sock resources: requests: memory: 512Mi @@ -80,7 +77,10 @@ spec: volumes: - name: data emptyDir: {} - # docker-sock hostPath intentionally removed + - name: docker-sock + hostPath: + path: /var/run/docker.sock + type: Socket --- # Neuron Technologies CI runner apiVersion: apps/v1 @@ -100,8 +100,10 @@ spec: labels: app: neuron-technologies-runner annotations: - config-version: "2026-04-25-buildkit-no-sock" + config-version: "2026-04-26-docker-sock" spec: + securityContext: + runAsNonRoot: false initContainers: - name: register image: registry.neuralplatform.ai/ci-base:latest @@ -121,7 +123,7 @@ spec: timeout: 3h container: network: host - docker_host: "tcp://buildkitd.ci.svc.cluster.local:1234" + docker_host: "unix:///var/run/docker.sock" force_pull: false valid_volumes: [] default_image: "registry.neuralplatform.ai/ci-base:latest" @@ -139,15 +141,14 @@ spec: image: registry.neuralplatform.ai/ci-base:latest workingDir: /data command: ["act_runner", "daemon", "--config", "/data/config.yaml"] - env: - - name: DOCKER_HOST - value: "tcp://buildkitd.ci.svc.cluster.local:1234" envFrom: - secretRef: name: neuron-technologies-runner-secret volumeMounts: - name: data mountPath: /data + - name: docker-sock + mountPath: /var/run/docker.sock resources: requests: memory: 512Mi @@ -158,3 +159,7 @@ spec: volumes: - name: data emptyDir: {} + - name: docker-sock + hostPath: + path: /var/run/docker.sock + type: Socket diff --git a/servers/legion/k8s/gitea-runner/buildkitd.yaml b/servers/legion/k8s/gitea-runner/buildkitd.yaml deleted file mode 100644 index 251ab5c..0000000 --- a/servers/legion/k8s/gitea-runner/buildkitd.yaml +++ /dev/null @@ -1,68 +0,0 @@ ---- -# BuildKit daemon — privileged image builder for CI runners. -# Runs as root with privileged=true in the isolated ci namespace. -# Rootless mode (moby/buildkit:*-rootless) fails on k3s/containerd because -# rootlesskit cannot share mount propagation on the container root fs. -# -# Runners connect via TCP: DOCKER_HOST=tcp://buildkitd.ci.svc.cluster.local:1234 -apiVersion: apps/v1 -kind: Deployment -metadata: - name: buildkitd - namespace: ci - labels: - app: buildkitd -spec: - replicas: 1 - selector: - matchLabels: - app: buildkitd - template: - metadata: - labels: - app: buildkitd - spec: - containers: - - name: buildkitd - image: moby/buildkit:v0.19.0 - args: - - --addr - - tcp://0.0.0.0:1234 - - --addr - - unix:///run/buildkit/buildkitd.sock - ports: - - name: tcp - containerPort: 1234 - securityContext: - privileged: true - readinessProbe: - tcpSocket: - port: 1234 # k3s/containerd can't exec into privileged containers - initialDelaySeconds: 5 - periodSeconds: 10 - resources: - requests: - cpu: 200m - memory: 256Mi - limits: - cpu: "4" - memory: 4Gi - volumeMounts: - - name: buildkit-storage - mountPath: /var/lib/buildkit - volumes: - - name: buildkit-storage - emptyDir: {} ---- -apiVersion: v1 -kind: Service -metadata: - name: buildkitd - namespace: ci -spec: - selector: - app: buildkitd - ports: - - name: tcp - port: 1234 - targetPort: 1234