feat: add a runner type without DinD for buildah-based build pipelines #29

New issue

Open

opened 2026-05-01 06:01:27 +00:00 by rcsheets · 2 comments

rcsheets commented

2026-05-01 06:01:27 +00:00

Owner

Now that brooktrails/pr-reviewer's build-push.yaml has migrated from docker build to buildah bud (with podman for the smoke test), it no longer needs a Docker-in-Docker sidecar. The current runs-on: [dind, trusted] selector still routes the job to a runner pool that brings up DinD as an unused dependency — extra pod startup time, extra memory, an extra privileged container that isn't doing anything.

Once a couple more workflows make the same migration (notably brooktrails/brooktrails-web's build-push.yaml), it would be worth defining a new lightweight runner type that:

Includes whatever [trusted] already implies for elevated capabilities (cgroup access, etc.).
Does NOT spin up a DinD sidecar.
Carries a distinct label (suggested: buildah or oci-build) so workflows can opt in deliberately rather than landing on it implicitly.

After that's available, pr-reviewer's runs-on becomes [buildah, trusted] (or whatever the chosen tag is) and the unused DinD sidecar drops away.

Open questions:

Naming.
Whether to phase out the dind runner type entirely once nothing references it, or keep both around for now.
Capability set — does the buildah runner need anything beyond what [trusted] already grants? (We currently force vfs storage and chroot isolation specifically because the runner doesn't have privileges to use overlay or runc-with-namespaces. A more privileged runner could lift those.)

Now that `brooktrails/pr-reviewer`'s `build-push.yaml` has migrated from `docker build` to `buildah bud` (with `podman` for the smoke test), it no longer needs a Docker-in-Docker sidecar. The current `runs-on: [dind, trusted]` selector still routes the job to a runner pool that brings up DinD as an unused dependency — extra pod startup time, extra memory, an extra privileged container that isn't doing anything. Once a couple more workflows make the same migration (notably `brooktrails/brooktrails-web`'s `build-push.yaml`), it would be worth defining a new lightweight runner type that: - Includes whatever `[trusted]` already implies for elevated capabilities (cgroup access, etc.). - Does NOT spin up a DinD sidecar. - Carries a distinct label (suggested: `buildah` or `oci-build`) so workflows can opt in deliberately rather than landing on it implicitly. After that's available, `pr-reviewer`'s `runs-on` becomes `[buildah, trusted]` (or whatever the chosen tag is) and the unused DinD sidecar drops away. Open questions: - Naming. - Whether to phase out the `dind` runner type entirely once nothing references it, or keep both around for now. - Capability set — does the buildah runner need anything beyond what `[trusted]` already grants? (We currently force `vfs` storage and `chroot` isolation specifically because the runner doesn't have privileges to use overlay or runc-with-namespaces. A more privileged runner could lift those.)

rcsheets commented

2026-06-26 00:36:04 +00:00

Author

Owner

Status update — groundwork in place as of v0.4.0.

The operator already exposes the two mechanics this runner type needs: KubernetesBackendSpec.Privileged=false omits the DinD sidecar entirely, and spec.Labels sets the runs-on tags a workflow opts into.

The key enabler landed in v0.4.0 (PR #31, "don't make non-DinD runners ping a docker daemon"): a non-privileged pool now sets docker_host: "-" and drops the DOCKER_HOST env, so a DinD-less runner actually executes jobs on the runner container instead of crashlooping against a daemon that isn't there. That bug was the prerequisite for a lightweight, no-DinD runner type, and it's now fixed and released.

**Status update — groundwork in place as of v0.4.0.** The operator already exposes the two mechanics this runner type needs: `KubernetesBackendSpec.Privileged=false` omits the DinD sidecar entirely, and `spec.Labels` sets the `runs-on` tags a workflow opts into. The key enabler landed in v0.4.0 (PR #31, *"don't make non-DinD runners ping a docker daemon"*): a non-privileged pool now sets `docker_host: "-"` and drops the `DOCKER_HOST` env, so a DinD-less runner actually executes jobs on the runner container instead of crashlooping against a daemon that isn't there. That bug was the prerequisite for a lightweight, no-DinD runner type, and it's now fixed and released.

rcsheets commented

2026-06-26 01:50:57 +00:00

Author

Owner

Further groundwork — host-execution labels (fix/non-dind-host-labels).

While debugging a non-DinD pool in production we found that the operator registered a non-privileged pool's labels bare (e.g. trusted,gllm), which Forgejo treats as Docker-executed — so the runner demanded a daemon at startup and crashlooped. The fix registers non-privileged pools with host-type labels (<name>:host), which run the job on the runner container and never require Docker. Privileged (DinD) pools are unchanged.

This is the missing piece for the lightweight runner type this issue asks for: a [buildah, trusted]-style pool can now run with no DinD sidecar and no daemon. When pr-reviewer migrates off DinD, flipping its pool to non-privileged is what triggers this path.

**Further groundwork — host-execution labels (`fix/non-dind-host-labels`).** While debugging a non-DinD pool in production we found that the operator registered a non-privileged pool's labels *bare* (e.g. `trusted,gllm`), which Forgejo treats as Docker-executed — so the runner demanded a daemon at startup and crashlooped. The fix registers non-privileged pools with **host-type labels** (`<name>:host`), which run the job on the runner container and never require Docker. Privileged (DinD) pools are unchanged. This is the missing piece for the lightweight runner type this issue asks for: a `[buildah, trusted]`-style pool can now run with no DinD sidecar and no daemon. When `pr-reviewer` migrates off DinD, flipping its pool to non-privileged is what triggers this path.

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

brooktrails/forgejo-runner-operator#29

No description provided.

Rows
Columns