Episode 2: Forgejo Actions — runner, Docker sandbox, own registry, locked-down deploy

runner-config.example.yml

@@ -0,0 +1,42 @@
+log:
+  level: info
+
+runner:
+  file: /data/.runner
+  # How many jobs may run at the same time. On a small box keep this low --
+  # your builds share CPU with everything else on the server.
+  capacity: 2
+  timeout: 1h
+  # Jobs get a docker client pointed at the sidecar, never at the host daemon.
+  envs:
+    DOCKER_HOST: tcp://docker:2376
+    DOCKER_TLS_VERIFY: "1"
+    DOCKER_CERT_PATH: /certs/client
+  # A label maps the name you write in "runs-on:" to the image the job runs in.
+  # This list is EMPTY by default -- and an empty list means every job you push
+  # waits forever with no error anywhere.
+  labels:
+    # The image behind a label must contain node -- Forgejo actions like
+    # checkout are JavaScript. A plain docker-cli image has no node and every
+    # JS action dies with "node: executable file not found".
+    - "docker:docker://code.forgejo.org/oci/node:22-bookworm"
+
+cache:
+  enabled: true
+
+container:
+  network: host
+  # Jobs talk to the docker-in-docker sidecar over TLS, never to the host daemon.
+  options: -v /certs/client:/certs/client
+  valid_volumes:
+    - /certs/client
+
+server:
+  # Declarative registration: same secret you passed to
+  # "forgejo forgejo-cli actions register --secret ...".
+  # A registration token from the web UI does NOT work here.
+  connections:
+    default:
+      url: https://git.example.com
+      uuid: ${RUNNER_UUID}
+      token: ${RUNNER_SECRET}