deploy, wiki: the bay1 runner is bounded by its attachments !358
2 files changed, +15 −10
Layout: unified · split
.gitbay/wiki/Admin.org +9 −6
| @@ -383,9 +383,11 @@ daemon instances; without the drop-in a deploy's copy over the admin | ||
| 383 | 383 | sshd stalled. Both deploy targets copy with =rsync --partial=, which |
| 384 | 384 | resumes a stalled transfer. |
| 385 | 385 | |
| 386 | v1 runs steps directly on the host — no containers — so treat the | |
| 387 | runner machine as executing whatever your users push. Install the | |
| 388 | toolchains your builds need on it. | |
| 386 | Under =-isolation podman=, the default and what bay1 runs, each build | |
| 387 | is confined to a container (see Container isolation below). Under | |
| 388 | =-isolation none= steps run directly on the host as the runner's user, | |
| 389 | so treat that machine as executing whatever your users push, and | |
| 390 | install the toolchains your builds need on it. | |
| 389 | 391 | |
| 390 | 392 | A runner claims the oldest pending build among the repositories its key |
| 391 | 393 | is attached to — for an admin key, the oldest in the instance. =-repos= |
| @@ -411,9 +413,10 @@ gitbay-runner -remote git@gitbay.org -repos krz/site,krz/docs \ | ||
| 411 | 413 | |
| 412 | 414 | Add =-untrusted= only with =-isolation podman=. |
| 413 | 415 | |
| 414 | gitbay.org's runner is scoped: it builds the forge's own repositories | |
| 415 | and the isolation canary, nothing else, because it shares the host with | |
| 416 | the forge; any other repository builds on a runner its owner attaches. | |
| 416 | gitbay.org's runner is attached to the forge's own repositories and | |
| 417 | the isolation canary, nothing else, because it shares the host with | |
| 418 | the forge; its unit names no =-repos=, the attachments are the | |
| 419 | boundary. Any other repository builds on a runner its owner attaches. | |
| 417 | 420 | |
| 418 | 421 | =-repos= narrows an admin runner; for a runner key the attachments are |
| 419 | 422 | the boundary, held by the server, and =-repos= may only name |
deploy/gitbay-runner.override.conf +6 −4
| @@ -23,9 +23,11 @@ | ||
| 23 | 23 | # would otherwise make read-only. Prepare the host with |
| 24 | 24 | # deploy/runner-podman-setup.sh before deploying a runner that isolates. |
| 25 | 25 | [Service] |
| 26 | # cmc/ci-smoke is the nightly isolation canary; a runner scoped to named | |
| 27 | # repositories never claims a build it is not scoped to, so the canary | |
| 28 | # must be listed or its scheduled build waits forever. | |
| 26 | # The runner polls as a non-admin account with a runner-scoped key, and | |
| 27 | # claims only the repositories that key is attached to (`repo runner | |
| 28 | # add`): krz/gitbay and cmc/ci-smoke. The attachments are the boundary, | |
| 29 | # so ExecStart names no -repos. cmc/ci-smoke is the nightly isolation | |
| 30 | # canary; keep it attached or its scheduled build waits forever. | |
| 29 | 31 | # |
| 30 | 32 | # Two layers of resource caps. MemoryMax and CPUQuota bound the unit — |
| 31 | 33 | # the runner and every build together — which is what keeps the forge |
| @@ -73,7 +75,7 @@ KillMode=mixed | ||
| 73 | 75 | # -untrusted: this runner isolates in podman, so it takes merge request |
| 74 | 76 | # heads from forks; a runner without a container must not. |
| 75 | 77 | ExecStart= |
| 76 | ExecStart=/usr/local/bin/gitbay-runner -remote git@127.0.0.1 -workdir /var/lib/gitbay-runner/work -poll 5s -timeout 45m -repos krz/gitbay,cmc/ci-smoke -isolation podman -image localhost/gitbay-ci:1 -cpus 3 -memory 6g -untrusted | |
| 78 | ExecStart=/usr/local/bin/gitbay-runner -remote git@127.0.0.1 -workdir /var/lib/gitbay-runner/work -poll 5s -timeout 45m -isolation podman -image localhost/gitbay-ci:1 -cpus 3 -memory 6g -untrusted | |
| 77 | 79 | Nice=10 |
| 78 | 80 | CPUWeight=30 |
| 79 | 81 | IOWeight=30 |