From 24a7eb79e58581dacbd9999e6de394e8b4da3c8d Mon Sep 17 00:00:00 2001 From: silverwind Date: Tue, 8 Sep 2026 18:26:25 +0000 Subject: [PATCH] Document GITEA_DOCKER_WORKSPACE (#535) Documents the variable added in https://gitea.com/gitea/runner/pulls/1204 and drops the `valid_volumes` requirement for `bind_workdir`, gone since https://gitea.com/gitea/runner/pulls/1203. Assisted by Claude (Fable 5.1). --------- Co-authored-by: Lunny Xiao Reviewed-on: https://gitea.com/gitea/docs/pulls/535 Reviewed-by: Lunny Xiao Co-authored-by: silverwind --- docs/usage/actions/variables.md | 1 + runner-docs/configuration.md | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/usage/actions/variables.md b/docs/usage/actions/variables.md index 958ed127..ac157a64 100644 --- a/docs/usage/actions/variables.md +++ b/docs/usage/actions/variables.md @@ -15,6 +15,7 @@ These environment variables are set automatically in every workflow run and can | `CI` | Always set to `true`. | `true` | | `GITEA_ACTIONS` | Always set to `true`. Useful to distinguish Gitea Actions from other CI systems. | `true` | | `GITEA_ACTIONS_RUNNER_VERSION` | The version of the runner executing the workflow. | `1.0.8` | +| `GITEA_DOCKER_WORKSPACE` | The workspace path as the Docker daemon sees it, for bind mounts into containers a job starts, e.g. `${GITEA_DOCKER_WORKSPACE:-.}/data:/app/data` in a compose file. Only set for jobs running in a container. | `/var/lib/docker/volumes/GITEA-ACTIONS-TASK-42_***/_data` | | `GITEA_ENV`
`GITHUB_ENV` | Path to the file that sets environment variables for subsequent steps. | `/home/runner/work/_temp/_runner_file_commands/set_env_***` | | `GITEA_OUTPUT`
`GITHUB_OUTPUT` | Path to the file that sets step output parameters. | `/home/runner/work/_temp/_runner_file_commands/set_output_***` | | `GITEA_PATH`
`GITHUB_PATH` | Path to the file that adds system `PATH` entries for subsequent steps. | `/home/runner/work/_temp/_runner_file_commands/add_path_***` | diff --git a/runner-docs/configuration.md b/runner-docs/configuration.md index ca6de0ac..6a514ee5 100644 --- a/runner-docs/configuration.md +++ b/runner-docs/configuration.md @@ -106,7 +106,7 @@ Applies to jobs that run in containers. | `force_rebuild` | `false` | rebuild local action images even when present. | | `require_docker` | `false` | always require a reachable daemon, even for host-only labels. | | `docker_timeout` | `0s` | how long to wait for the daemon to become reachable. | -| `bind_workdir` | `false` | bind-mount the workspace from the host instead of using a docker volume. Needed for jobs that use `docker compose` with bind mounts under Docker-in-Docker. The parent directory must then be mounted into the runner container and listed in `valid_volumes`. | +| `bind_workdir` | `false` | bind-mount the workspace from the host instead of using a docker volume, so jobs can bind-mount it by its own path into containers they start (`.:/app` in `docker compose`). Not needed when workflows use `GITEA_DOCKER_WORKSPACE`. The parent directory must then be mounted into the runner container. | :::note Privileged mode and workflow container options A workflow's own `jobs..container.options` are untrusted input. While `container.privileged` is disabled, the options that would break out of the container are stripped with a warning in the job log: `--pid`, `--ipc`, `--uts`, `--cgroupns`, `--userns`, `--cap-add`, `--security-opt`, `--device`, `--device-cgroup-rule`, `--gpus`, `--volumes-from`, `--runtime`, `--cgroup-parent` and `--sysctl`. They are honoured once privileged mode is enabled, because the operator has then opted into host access.