mirror of
https://gitea.com/gitea/runner.git
synced 2026-11-06 23:30:29 +00:00
bircni
993389d428
The bundled Docker daemon pulls job images, so it needs to trust a private registry's CA itself, which `runner.ca_file` doesn't cover. Documents the `certs.d` mount for both dind images. Ref: https://gitea.com/gitea/runner/issues/1390 Reviewed-on: https://gitea.com/gitea/runner/pulls/1397 Reviewed-by: Lunny Xiao <[email protected]>
1.1 KiB
1.1 KiB
Run gitea-runner in a Docker Container
The recommended Docker-in-Docker image runs its own Docker daemon for jobs, so they never get the host's Docker socket:
docker run --privileged \
-e GITEA_INSTANCE_URL=http://192.168.8.18:3000 \
-e GITEA_RUNNER_REGISTRATION_TOKEN=<runner_token> \
-v "$PWD/data:/data" \
-v runner-docker:/var/lib/docker \
--name my_runner gitea/runner:latest-dind
The volumes keep the runner's registration and the job image cache. See image flavours for alternatives.
Pull job images from a registry with a private CA
The bundled Docker daemon pulls job images, so it needs to trust the registry's CA itself. runner.ca_file doesn't cover this. Mount the CA where the daemon looks for it, naming the directory after the registry's host and port:
--mount "type=bind,src=$PWD/ca.crt,dst=/etc/docker/certs.d/registry.example.com:5000/ca.crt,readonly"
Use --mount, since -v rejects a container path with a port in it.
On latest-dind-rootless, use /home/rootless/.config/docker/certs.d/registry.example.com:5000/ca.crt as the target.