| 1 | # syntax=docker/dockerfile:1.7 |
| 2 | # |
| 3 | # The self-hosted runner's image: `g1t-runner` with a Docker Engine of its |
| 4 | # own, for Sysbox. The runner starts `dockerd` inside this container and |
| 5 | # runs each job in a fresh container on it, so jobs are containers inside |
| 6 | # the runner's container and nothing reaches the machine: Sysbox gives the |
| 7 | # container its own user namespace (its root is no one on the machine) and |
| 8 | # lets it run Docker without --privileged. Never mount the machine's |
| 9 | # /var/run/docker.sock: the runner refuses to start when it sees one. |
| 10 | # |
| 11 | # docker run -d --name g1t-runner --restart unless-stopped \ |
| 12 | # --runtime=sysbox-runc \ |
| 13 | # -v g1t-runner:/data \ |
| 14 | # -e G1T_RUNNER_URL=https://g1t.sh -e G1T_RUNNER_TOKEN=g1trt_… \ |
| 15 | # g1t.sh/flagon-io/g1t-runner |
| 16 | # |
| 17 | # PID 1 is docker-init (tini), which supervises g1t-runner and reaps what it |
| 18 | # leaves; g1t-runner supervises dockerd (crates/runner/src/selfhosted/engine.rs). |
| 19 | # git, bash and Node stay for host mode (G1T_RUNNER_NO_DOCKER=1), which is |
| 20 | # deprecated. |
| 21 | # |
| 22 | # Build context: a folder holding `g1t-runner` for the image's platform, |
| 23 | # the static Linux build that scripts/runner-release.mjs makes (or |
| 24 | # scripts/build-runner.mjs, for x64). The release workflow builds and |
| 25 | # pushes it for linux/amd64 and linux/arm64. |
| 26 | |
| 27 | # Docker's static builds: the engine, containerd, runc, the CLI, tini. |
| 28 | FROM docker:28-dind AS docker |
| 29 | |
| 30 | FROM node:24-bookworm-slim |
| 31 | RUN apt-get update \ |
| 32 | && apt-get install -y --no-install-recommends git ca-certificates curl iptables procps \ |
| 33 | && rm -rf /var/lib/apt/lists/* \ |
| 34 | && mkdir -p /data /home/runner |
| 35 | COPY --from=docker /usr/local/bin/dockerd /usr/local/bin/containerd /usr/local/bin/containerd-shim-runc-v2 \ |
| 36 | /usr/local/bin/ctr /usr/local/bin/runc /usr/local/bin/docker-proxy /usr/local/bin/docker-init \ |
| 37 | /usr/local/bin/docker /usr/local/bin/ |
| 38 | COPY --chmod=0755 g1t-runner /usr/local/bin/g1t-runner |
| 39 | # Its configuration and credential live on this volume. Sysbox keeps the |
| 40 | # engine's /var/lib/docker on the machine's disk for this container alone. |
| 41 | ENV G1T_RUNNER_DIR=/data \ |
| 42 | G1T_RUNNER_SANDBOX=nested |
| 43 | VOLUME /data |
| 44 | ENTRYPOINT ["docker-init", "--", "g1t-runner"] |
| 45 | CMD ["register-and-run"] |