deploy, wiki: the bay1 runner is bounded by its attachments !358

merged merged by cmc on 2026-09-10 01:36 UTC · krz/gitbay:runner-attach-only into main

2 files changed, +15 −10

Layout: unified · split

.gitbay/wiki/Admin.org +9 −6

 sshd stalled. Both deploy targets copy with =rsync --partial=, which
 resumes a stalled transfer.
-v1 runs steps directly on the host — no containers — so treat the
+Under =-isolation podman=, the default and what bay1 runs, each build
-runner machine as executing whatever your users push. Install the
+is confined to a container (see Container isolation below). Under
-toolchains your builds need on it.
+=-isolation none= steps run directly on the host as the runner's user,
+so treat that machine as executing whatever your users push, and
+install the toolchains your builds need on it.
 A runner claims the oldest pending build among the repositories its key
 is attached to — for an admin key, the oldest in the instance. =-repos=
 Add =-untrusted= only with =-isolation podman=.
-gitbay.org's runner is scoped: it builds the forge's own repositories
+gitbay.org's runner is attached to the forge's own repositories and
-and the isolation canary, nothing else, because it shares the host with
+the isolation canary, nothing else, because it shares the host with
-the forge; any other repository builds on a runner its owner attaches.
+the forge; its unit names no =-repos=, the attachments are the
+boundary. Any other repository builds on a runner its owner attaches.
 =-repos= narrows an admin runner; for a runner key the attachments are
 the boundary, held by the server, and =-repos= may only name

deploy/gitbay-runner.override.conf +6 −4

 # would otherwise make read-only. Prepare the host with
 # deploy/runner-podman-setup.sh before deploying a runner that isolates.
 [Service]
-# cmc/ci-smoke is the nightly isolation canary; a runner scoped to named
+# The runner polls as a non-admin account with a runner-scoped key, and
-# repositories never claims a build it is not scoped to, so the canary
+# claims only the repositories that key is attached to (`repo runner
-# must be listed or its scheduled build waits forever.
+# add`): krz/gitbay and cmc/ci-smoke. The attachments are the boundary,
+# so ExecStart names no -repos. cmc/ci-smoke is the nightly isolation
+# canary; keep it attached or its scheduled build waits forever.
 #
 # Two layers of resource caps. MemoryMax and CPUQuota bound the unit —
 # the runner and every build together — which is what keeps the forge
 # -untrusted: this runner isolates in podman, so it takes merge request
 # heads from forks; a runner without a container must not.
 ExecStart=
-ExecStart=/usr/local/bin/gitbay-runner -remote git@127.0.0.1 -workdir /var/lib/gitbay-runner/work -poll 5s -timeout 45m -repos krz/gitbay,cmc/ci-smoke -isolation podman -image localhost/gitbay-ci:1 -cpus 3 -memory 6g -untrusted
+ExecStart=/usr/local/bin/gitbay-runner -remote git@127.0.0.1 -workdir /var/lib/gitbay-runner/work -poll 5s -timeout 45m -isolation podman -image localhost/gitbay-ci:1 -cpus 3 -memory 6g -untrusted
 Nice=10
 CPUWeight=30
 IOWeight=30