Commit 8e2dbc6807
8e2dbc6807391812295e92a49ddf92e2b4bc1fb7
parent: 7a667c7b40
Verified · cmc ci/build: success ci/test: success
cmc <hello@cleberg.net> · 2026-09-10 01:26 UTC
deploy, wiki: the bay1 runner is bounded by its attachments, not -repos
The unit drops -repos; the key's attachments to krz/gitbay and
cmc/ci-smoke are what it may claim. Admin no longer says v1 runs on
the host with no containers.
Ref #184
.gitbay/wiki/Admin.org
+9 −6
| @@ -383,9 +383,11 @@ daemon instances; without the drop-in a deploy's copy over the admin |
| 383 | 383 | sshd stalled. Both deploy targets copy with =rsync --partial=, which |
| 384 | 384 | resumes a stalled transfer. |
| 385 | 385 | |
| 386 | | v1 runs steps directly on the host — no containers — so treat the |
| 387 | | runner machine as executing whatever your users push. Install the |
| 388 | | toolchains your builds need on it. |
| 386 | Under =-isolation podman=, the default and what bay1 runs, each build |
| 387 | is confined to a container (see Container isolation below). Under |
| 388 | =-isolation none= steps run directly on the host as the runner's user, |
| 389 | so treat that machine as executing whatever your users push, and |
| 390 | install the toolchains your builds need on it. |
| 389 | 391 | |
| 390 | 392 | A runner claims the oldest pending build among the repositories its key |
| 391 | 393 | is attached to — for an admin key, the oldest in the instance. =-repos= |
| @@ -411,9 +413,10 @@ gitbay-runner -remote git@gitbay.org -repos krz/site,krz/docs \ |
| 411 | 413 | |
| 412 | 414 | Add =-untrusted= only with =-isolation podman=. |
| 413 | 415 | |
| 414 | | gitbay.org's runner is scoped: it builds the forge's own repositories |
| 415 | | and the isolation canary, nothing else, because it shares the host with |
| 416 | | the forge; any other repository builds on a runner its owner attaches. |
| 416 | gitbay.org's runner is attached to the forge's own repositories and |
| 417 | the isolation canary, nothing else, because it shares the host with |
| 418 | the forge; its unit names no =-repos=, the attachments are the |
| 419 | boundary. Any other repository builds on a runner its owner attaches. |
| 417 | 420 | |
| 418 | 421 | =-repos= narrows an admin runner; for a runner key the attachments are |
| 419 | 422 | the boundary, held by the server, and =-repos= may only name |
deploy/gitbay-runner.override.conf
+6 −4
| @@ -23,9 +23,11 @@ |
| 23 | 23 | # would otherwise make read-only. Prepare the host with |
| 24 | 24 | # deploy/runner-podman-setup.sh before deploying a runner that isolates. |
| 25 | 25 | [Service] |
| 26 | | # cmc/ci-smoke is the nightly isolation canary; a runner scoped to named |
| 27 | | # repositories never claims a build it is not scoped to, so the canary |
| 28 | | # must be listed or its scheduled build waits forever. |
| 26 | # The runner polls as a non-admin account with a runner-scoped key, and |
| 27 | # claims only the repositories that key is attached to (`repo runner |
| 28 | # add`): krz/gitbay and cmc/ci-smoke. The attachments are the boundary, |
| 29 | # so ExecStart names no -repos. cmc/ci-smoke is the nightly isolation |
| 30 | # canary; keep it attached or its scheduled build waits forever. |
| 29 | 31 | # |
| 30 | 32 | # Two layers of resource caps. MemoryMax and CPUQuota bound the unit — |
| 31 | 33 | # the runner and every build together — which is what keeps the forge |
| @@ -73,7 +75,7 @@ KillMode=mixed |
| 73 | 75 | # -untrusted: this runner isolates in podman, so it takes merge request |
| 74 | 76 | # heads from forks; a runner without a container must not. |
| 75 | 77 | ExecStart= |
| 76 | | ExecStart=/usr/local/bin/gitbay-runner -remote git@127.0.0.1 -workdir /var/lib/gitbay-runner/work -poll 5s -timeout 45m -repos krz/gitbay,cmc/ci-smoke -isolation podman -image localhost/gitbay-ci:1 -cpus 3 -memory 6g -untrusted |
| 78 | ExecStart=/usr/local/bin/gitbay-runner -remote git@127.0.0.1 -workdir /var/lib/gitbay-runner/work -poll 5s -timeout 45m -isolation podman -image localhost/gitbay-ci:1 -cpus 3 -memory 6g -untrusted |
| 77 | 79 | Nice=10 |
| 78 | 80 | CPUWeight=30 |
| 79 | 81 | IOWeight=30 |