A simple container image for building containers using buildah, podman, Gitea/Github Actions.
name: Build image using rootless builder
run-name: ${{ gitea.actor }} is testing 🚀
on:
push:
branches: [ main ]
jobs:
build:
name: Build and push image
runs-on: ubuntu-latest
container:
image: docker.io/adathor/rootless-builder:latest
options: --security-opt label=disabled --device /dev/fuse ## buildah needs fuse to work
# credentials: ## If pulling from a private registry
# username: ${{ secrets.DOCKER_REGISTRY_USER }}
# password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
steps:
- uses: actions/checkout@v2
- name: Build Image
id: build-image
uses: redhat-actions/buildah-build@v2
with:
image: test
tags: latest ${{ github.sha }}
containerfiles: |
./Containerfile
- name: Push To Dockerhub
id: push-to-docker
uses: redhat-actions/push-to-registry@v2
with:
image: ${{ steps.build-image.outputs.image }}
tags: ${{ steps.build-image.outputs.tags }}
registry: registry.adathor.com/dewhoops/test
username: ${{ secrets.DOCKER_REGISTRY_USER }}
password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
- Get a registration token from your Gitea instance
- Install podman and docker on the host, and enable
podman.socket
service for the user that will run the runner (systemctl --user enable --now podman.socket
)- Could work without docker installed, just make a symlink from
/usr/bin/podman
to/usr/bin/docker
- Could work without docker installed, just make a symlink from
- Create a runner using the token:
podman run \
--authfile=$HOME/.secret/auth.json \
-v $PWD/config.yaml:/config.yaml:z \
-v $PWD/data:/data:z \
-v /run/user/1000/podman/podman.sock:/var/run/docker.sock \
--security-opt label=disable \ ## If SELinux is enabled
-e CONFIG_FILE=/config.yaml \
-e GITEA_INSTANCE_URL=https://gitea.adathor.com \
-e GITEA_RUNNER_REGISTRATION_TOKEN=SuperSecretSquirrel \
-e GITEA_RUNNER_NAME=kazeshini \
-e GITEA_RUNNER_LABELS="ubuntu-latest:docker://node:16-bullseye" \
--name gitea-runner \
-d docker.io/gitea/act_runner:latest
Since the Gitea and Github actions are interoperable follow the Github instructions for the runner deployment.
$HOME/.config/containers/systemd/gitea-runner.yml
:
---
apiVersion: v1
kind: Pod
metadata:
annotations:
io.containers.autoupdate: "registry"
labels:
app: gitea-runner-pod
name: gitea-runner-pod
spec:
containers:
- name: gitea-runner
image: docker.io/gitea/act_runner:latest
securityContext:
seLinuxOptions:
type: spc_t
env:
- name: GITEA_INSTANCE_URL
value: https://gitea.adathor.com
- name: GITEA_RUNNER_REGISTRATION_TOKEN
valueFrom:
secretKeyRef:
name: gitea-runner-regtoken
key: gitea-runner-token
- name: GITEA_RUNNER_NAME
value: vegas
- name: GITEA_RUNNER_LABELS
value: ubuntu-latest:docker://node:16-bullseye
- name: CONFIG_FILE
value: /config.yaml
volumeMounts:
- mountPath: /data
name: home-podman_vol-gitea-data-host-0
- mountPath: /var/run/docker.sock
name: run-user-1000-podman-podman.sock-host-1
- mountPath: /config.yaml
name: home-podman_vol-gitea-config.yaml-host-2
volumes:
- hostPath:
path: /home/podman_vol/gitea/data
type: Directory
name: home-podman_vol-gitea-data-host-0
- hostPath:
path: /run/user/1000/podman/podman.sock
type: File
name: run-user-1000-podman-podman.sock-host-1
- hostPath:
path: /home/podman_vol/gitea/config.yaml
type: File
name: home-podman_vol-gitea-config.yaml-host-2
---
apiVersion: v1
kind: Secret
metadata:
name: gitea-runner-regtoken
data:
gitea-runner-token: U3VwZXJTZWNyZXRTcXVpcnJlbA==
$HOME/.config/containers/systemd/gitea-runner.yml
:
[Unit]
After=home-podman_vol.mount gitea.service
[Install]
WantedBy=default.target
[Kube]
Yaml=$HOME/.config/containers/systemd/gitea-runner.yml
[Service]
TimeoutStartSec=900
ExecStartPre=/usr/bin/sleep 5