overlay2 (the default) tries to mount an overlayfs layer on top of
the job container's own overlay-mounted root filesystem, which the
kernel rejects (invalid argument). vfs sidesteps nested overlay
mounts entirely.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The dind sidecar's hostname failed to resolve via the embedded DNS
resolver (server misbehaving), so cross-container service networking
isn't working reliably here. Run dockerd directly inside the (now
privileged) job container instead, avoiding service networking
entirely.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The runner-side docker CLI/DOCKER_HOST config described by the host
admin doesn't appear to be live yet (default label still has no
docker CLI; a custom container never saw DOCKER_HOST injected). Go
back to a fully self-contained job: own dind sidecar + explicit
DOCKER_HOST, plain docker build/push instead of buildx (which reads
its endpoint from the docker context file rather than DOCKER_HOST).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Setting container: node:20-bookworm replaced the runner's default
job image wholesale, which is where DOCKER_HOST and the docker CLI
were actually pre-configured. Use the default image so that config
applies.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
docker/setup-buildx-action resolves its builder endpoint from the
docker context file rather than the live DOCKER_HOST env var, so it
still tried the (absent) unix socket. Plain docker CLI commands
honor DOCKER_HOST directly, matching what the runner now provides.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The Forgejo runner infra now gives job containers a privileged
container pre-wired to its own dind sidecar via DOCKER_HOST, so
defining our own docker:dind service would start a conflicting
second daemon. Keep the node image + docker CLI install (still
needed) and drop the services/env block.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
JS actions (checkout, login-action, etc.) need Node.js, so the docker
CLI-only alpine image couldn't run them. Switch to node:20-bookworm and
install the docker CLI/buildx plugin as a step instead.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The runner's default job image has no docker binary. Run the job in
docker:27-cli with a docker:27-dind sidecar service instead of relying
on the runner exposing a host docker socket.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
