Container Images

This repo contains how the images for action runners in git.arkforge.net works. The images themselves are hosted at images directory. Build them with:

# build the image
docker buildx build -t alpine_base:latest -f alpine_base .
# tag it in the container registry
docker tag alpine_base:latest git.arkforge.net/arkforgelabs/containerimages:alpine_base
# login to the registry with your access token
docker login git.arkforge.net -u UserName
# and finally push the image
docker push git.arkforge.net/arkforgelabs/containerimages:alpine_base

Then make sure to have the certificates generated for https access inside:

chmod +x generate-certs.sh
sudo ./generate-certs.sh

And finally make sure your docker-compose.yml for your runner looks like this:

docker-in-docker:
  image: docker:dind
  container_name: 'docker_dind'
  privileged: true
  volumes:
    - /opt/docker-certs:/certs:ro
  command: >
    dockerd
    -H tcp://0.0.0.0:2375
    --tls=true
    --tlscacert=/certs/ca.pem
    --tlscert=/certs/server-cert.pem
    --tlskey=/certs/server-key.pem
    --insecure-registry=forgejo:3000
  restart: 'unless-stopped'
  networks:
    - forgejo

forgejo-runner:
  image: 'data.forgejo.org/forgejo/runner:12'
  container_name: 'runner'
  volumes:
    - /opt/docker-certs:/certs:ro
    - ./forgejo_runner_data:/data
  environment:
    DOCKER_HOST: tcp://docker_dind:2375
    DOCKER_TLS_VERIFY: "1"
    DOCKER_CERT_PATH: /certs
  user: 1001:1001
  restart: 'unless-stopped'
  command: 'forgejo-runner daemon --config runner-config.yml'
  depends_on:
    docker-in-docker:
      condition: service_started
  networks:
    - forgejo

Monthly automated builds

images/build.sh rebuilds alpine_base and pushes it to the container registry with an incremental version tag (alpine_base-vX.Y, e.g. alpine_base-v1.2 → alpine_base-v1.3). The next version is discovered by querying the registry's /v2/.../tags/list endpoint, so no state is kept on the build machine; if the registry has no alpine_base tags yet, the first push is alpine_base-v1.0.

Manual run (on any machine with docker; log in once first):

docker login git.arkforge.net
./images/build.sh localhost:3000
# any host works, with or without a scheme:
./images/build.sh https://git.arkforge.net

To preview the version that would be pushed right now:

./images/build.sh --print-version <<< '{"tags":["alpine_base-v1.2"]}'   # prints 1.3

systemd timer (Linux host)

1. Clone this repo on the server and adjust the paths and host in deploy/container-images.service if needed.
2. Install and enable the timer (runs on the first day of every month; Persistent=true also catches up a run missed while the machine was off):

sudo cp deploy/container-images.service deploy/container-images.timer /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now container-images.timer

3. Verify with systemctl list-timers container-images.timer; inspect a run with journalctl -u container-images.service.

If the registry needs authentication for the tag listing, set REGISTRY_USER and REGISTRY_TOKEN as environment variables or in the unit file. The push itself uses the credentials stored by docker login.