chore: unify runner naming to sharedinbox-runner

2026-05-08 12:55:16 +02:00
parent 06cf8c7f99
commit 67e6b4ebb9
6 changed files with 45 additions and 37 deletions
@@ -61,4 +61,4 @@ linux/flutter/generated_plugins.cmake

 *.log
 runner-data/
-codeberg-runner/runner-data/
+sharedinbox-runner/runner-data/
@@ -1,18 +0,0 @@
-# Dockerfile for a Codeberg Runner with Nix installed
-FROM gitea/act_runner:latest
-
-# Install Nix requirements and basic tools
-RUN apt-get update && apt-get install -y curl xz-utils sudo && rm -rf /var/lib/apt/lists/*
-
-# Install Nix in single-user mode (suitable for container)
-# We use the Determinate Systems installer for reliability
-RUN curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | sh -s -- install linux \
-    --init none \
-    --no-confirm
-
-# Add Nix to PATH
-ENV PATH="/nix/var/nix/profiles/default/bin:${PATH}"
-ENV NIX_PATH="nixpkgs=channel:nixos-unstable"
-
-# Ensure the runner user can use Nix
-RUN echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf
@@ -1,18 +0,0 @@
-[Unit]
-Description=Codeberg CI Runner (Docker Compose)
-Requires=docker.service
-After=docker.service network-online.target
-
-[Service]
-Type=simple
-User=root
-Group=root
-WorkingDirectory=/
-ExecStartPre=-/usr/bin/docker compose -f /opt/sharedinbox-runner/codeberg-runner/docker-compose.yml down
-ExecStart=/usr/bin/docker compose -f /opt/sharedinbox-runner/codeberg-runner/docker-compose.yml up --build
-ExecStop=/usr/bin/docker compose -f /opt/sharedinbox-runner/codeberg-runner/docker-compose.yml down
-Restart=always
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target
@@ -0,0 +1,26 @@
+# Dockerfile for a Codeberg Runner with Nix and a non-root worker
+FROM gitea/act_runner:latest
+
+# Install Nix requirements and basic tools
+RUN apt-get update && apt-get install -y curl xz-utils sudo && rm -rf /var/lib/apt/lists/*
+
+# Install Nix in single-user mode
+RUN curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | sh -s -- install linux \
+    --init none \
+    --no-confirm
+
+ENV PATH="/nix/var/nix/profiles/default/bin:${PATH}"
+RUN echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf
+
+# Create a restricted 'worker' user for running the actual CI jobs
+RUN useradd -m -s /bin/bash worker && \
+    mkdir -p /home/worker && \
+    chown -R worker:worker /home/worker
+
+# Allow the worker user to use Nix
+RUN chown -R worker:worker /nix/var/nix/profiles/per-user/worker || true && \
+    chmod -R 777 /nix/store /nix/var/nix/db
+
+# We still start as root so the act_runner entrypoint can initialize, 
+# but the 'act_runner' is configured to run jobs as a specific user if requested.
+# However, by default, act_runner executes inside this container.
@@ -0,0 +1,18 @@
+[Unit]
+Description=SharedInbox CI Runner (Docker Compose)
+Requires=docker.service
+After=docker.service network-online.target
+
+[Service]
+Type=simple
+User=root
+Group=root
+WorkingDirectory=/
+ExecStartPre=-/usr/bin/docker compose -f /opt/sharedinbox-runner/sharedinbox-runner/docker-compose.yml down
+ExecStart=/usr/bin/docker compose -f /opt/sharedinbox-runner/sharedinbox-runner/docker-compose.yml up --build
+ExecStop=/usr/bin/docker compose -f /opt/sharedinbox-runner/sharedinbox-runner/docker-compose.yml down
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target