test-forgejo-runner

A throwaway repo for exercising the Forgejo Actions runners in k8s-lys/apps/forgejo-runners. It builds a docker image on the runner and runs it. It never pushes the image anywhere.

What it checks

.forgejo/workflows/build.yml has two jobs:

job	runs-on	image	checks
build	ubuntu-latest	catthehacker/ubuntu:act-latest	checkout over the public URL, docker cli sees the dind socket, docker build (registry pull, network from a build step, multi-stage), docker run of the result
socket	docker	node:22-bookworm	checkout, the socket is bind-mounted even where there is no docker cli, the daemon answers over it

The Dockerfile is small on purpose: the runner has no image cache, so every layer is pulled on every job.

Use

1. Create an empty repo on https://forge.lysator.liu.se, enable Actions under Settings → Units → Actions.

2. Push this:

   git remote add origin ssh://git@forge.lysator.liu.se/<owner>/test-forgejo-runner.git
   git push -u origin main
   

3. Watch the run under the repo's Actions tab, and the pods on the cluster get replaced as each job finishes:

   kubectl -n forgejo-runners get pods -w
   

The workflow also runs on workflow_dispatch, so it can be re-triggered from the Actions tab without a new commit.

Reading a failure

Roughly in the order the runner README lists its suspects:

• No job ever picked up: no Idle runner with the label on https://forge.lysator.liu.se/-/admin/actions/runners. Runner side, not this repo.
• actions/checkout fails: the clone from https://forge.lysator.liu.se from inside the VM does not hairpin through the gateway.
• ls /var/run/docker.sock fails: the runner did not bind-mount the dind socket into the job container (container.docker_host in the runner ConfigMap).
• docker version shows the client but no server: socket is there, dind is not answering. Look at the dind container's log.
• docker build fails at FROM or apk add: the dind daemon has no network out of the VM, or Docker Hub is rate-limiting the node's IP.
• docker build fails with an overlay2 / storage driver error: the loop-mounted /var/lib/docker in the dind sidecar.
• cache job: runner has no cache configured: the pod that took the job started with cache.enabled: false, or the runner never started at all. If the runner container logs cannot read secret ... permission denied, the secret volume's mode does not let uid 1000 read it.
• cache job: connection error to http://10.x.x.x:NNNNN/: the job container cannot route to the proxy on the pod IP; cache.host in the runner ConfigMap. A 403 is a secret mismatch between runner and server.

Local check

The Dockerfile builds on any docker host:

docker build -t test-forgejo-runner .
docker run --rm test-forgejo-runner