Will Anderson
bec948bcca
The Gitea Actions runners on Legion need build containers to be able to clone repos. They run with network: host so they can't resolve gitea.git.svc.cluster.local — they have to use the public URL. The public URL sits behind Cloudflare Access, which is why the previous naive switch (#3) had to be reverted. This change keeps the runner daemon registered against the in-cluster URL (no CF Access on the polling loop) but rewrites http://gitea.git.svc.cluster.local:3000/ to https://git.neuralplatform.ai/ inside the build container, with the CF Access service-token headers injected via git extraHeader. The redirect script is sourced before every job step via BASH_ENV; the CF Access credentials reach the build container through act_runner's container.env, which we now populate from the new gitea-runner-cf-access Vault path that PR #5's Terraform writes. Known limitation documented in the init script: actions/checkout's per-job auth header is keyed to the in-cluster URL and gets dropped after the insteadOf rewrite. Public repos work; private repos that need that token will need a follow-up.
100 lines
3.4 KiB
Docker
100 lines
3.4 KiB
Docker
FROM data.forgejo.org/forgejo/runner:11 AS runner-bin
|
|
|
|
FROM ubuntu:24.04
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
|
|
COPY --from=runner-bin /bin/forgejo-runner /usr/local/bin/act_runner
|
|
|
|
# Core system tools
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
curl \
|
|
wget \
|
|
git \
|
|
gnupg \
|
|
lsb-release \
|
|
unzip \
|
|
zip \
|
|
xz-utils \
|
|
tar \
|
|
rsync \
|
|
file \
|
|
jq \
|
|
openssh-client \
|
|
make \
|
|
build-essential \
|
|
pkg-config \
|
|
software-properties-common \
|
|
zstd \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Node.js 20 LTS via binary tarball (nodesource apt repo is unreliable on Ubuntu 24.04)
|
|
RUN NODE_VERSION=20.19.1 \
|
|
&& curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" \
|
|
| tar -xJ -C /usr/local --strip-components=1 \
|
|
&& node --version \
|
|
&& npm --version \
|
|
&& npm install -g yarn
|
|
|
|
# Python 3 + pip + venv
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
python3 \
|
|
python3-pip \
|
|
python3-venv \
|
|
python3-dev \
|
|
&& ln -sf /usr/bin/python3 /usr/local/bin/python \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Ruby + Bundler
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ruby \
|
|
ruby-dev \
|
|
ruby-bundler \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Go 1.22
|
|
RUN curl -fsSL https://go.dev/dl/go1.22.10.linux-amd64.tar.gz | tar -C /usr/local -xz
|
|
ENV PATH="/usr/local/go/bin:${PATH}"
|
|
|
|
# Docker CLI (socket mounted from host)
|
|
RUN curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg \
|
|
&& echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu noble stable" \
|
|
> /etc/apt/sources.list.d/docker.list \
|
|
&& apt-get update \
|
|
&& apt-get install -y --no-install-recommends docker-ce-cli \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# kubectl
|
|
RUN curl -fsSL "https://dl.k8s.io/release/$(curl -Ls https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
|
|
-o /usr/local/bin/kubectl \
|
|
&& chmod +x /usr/local/bin/kubectl
|
|
|
|
# Helm
|
|
RUN curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
|
|
|
|
# yq
|
|
RUN wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 \
|
|
&& chmod +x /usr/local/bin/yq
|
|
|
|
# GitHub CLI
|
|
RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
|
|
| dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \
|
|
&& echo "deb [arch=amd64 signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
|
|
> /etc/apt/sources.list.d/github-cli.list \
|
|
&& apt-get update \
|
|
&& apt-get install -y --no-install-recommends gh \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Cloudflare Access bootstrap for git clones to git.neuralplatform.ai.
|
|
# This script is sourced by bash in build containers via BASH_ENV (set by
|
|
# act_runner's container.env in deployment.yaml) so it runs before every
|
|
# step. It configures git insteadOf + CF Access extraHeaders from
|
|
# CF_ACCESS_CLIENT_ID / CF_ACCESS_CLIENT_SECRET env vars.
|
|
#
|
|
# We deliberately don't set ENTRYPOINT / CMD here — act_runner spawns
|
|
# build containers with its own entrypoint to keep them alive between
|
|
# steps, and overriding it breaks job execution.
|
|
COPY git-cf-access-init.sh /usr/local/bin/git-cf-access-init.sh
|
|
RUN chmod +x /usr/local/bin/git-cf-access-init.sh
|